azorult | 27fdec7935a10e8c7217c0cdfa4a4f4ddc6f32f62df49dc00e104476b5bec065

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 10:31

Target

175fe32bf9c49be859baa991f21dcdcf.exe
Size

539KB
MD5

175fe32bf9c49be859baa991f21dcdcf
SHA1

3104ffad96380a74b484f9426a02a0364cc9c3b8
SHA256

27fdec7935a10e8c7217c0cdfa4a4f4ddc6f32f62df49dc00e104476b5bec065
SHA512

6f37421ab9e36aa8c81ffccc45f57bd879ff3dd7a2566653f59a6e99708fffbb06616c201881716a5ebe5d32bc69ab1607e9cf34660c9ca6d0845ae46084c13e
SSDEEP

6144:8U723+VM5v2GhNbpG+5F5XTM//SlrTWIZrV9XaAbootg+4yi9v+zA1DJcOfUm:9723V2iNb4s/kGrTWIZasZg+4yzOsm

Score

10^/10

Family

azorult

http://193.247.144.166/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

175fe32bf9c49be859baa991f21dcdcf.exe

description pid process target process

PID 2012 set thread context of 2768 2012 175fe32bf9c49be859baa991f21dcdcf.exe 175fe32bf9c49be859baa991f21dcdcf.exe

description	pid	process	target process
PID 2012 set thread context of 2768	2012	175fe32bf9c49be859baa991f21dcdcf.exe	175fe32bf9c49be859baa991f21dcdcf.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

175fe32bf9c49be859baa991f21dcdcf.exe

description	pid	process	target process
PID 2012 wrote to memory of 2768	2012	175fe32bf9c49be859baa991f21dcdcf.exe	175fe32bf9c49be859baa991f21dcdcf.exe
PID 2012 wrote to memory of 2768	2012	175fe32bf9c49be859baa991f21dcdcf.exe	175fe32bf9c49be859baa991f21dcdcf.exe
PID 2012 wrote to memory of 2768	2012	175fe32bf9c49be859baa991f21dcdcf.exe	175fe32bf9c49be859baa991f21dcdcf.exe
PID 2012 wrote to memory of 2768	2012	175fe32bf9c49be859baa991f21dcdcf.exe	175fe32bf9c49be859baa991f21dcdcf.exe
PID 2012 wrote to memory of 2768	2012	175fe32bf9c49be859baa991f21dcdcf.exe	175fe32bf9c49be859baa991f21dcdcf.exe
PID 2012 wrote to memory of 2768	2012	175fe32bf9c49be859baa991f21dcdcf.exe	175fe32bf9c49be859baa991f21dcdcf.exe
PID 2012 wrote to memory of 2768	2012	175fe32bf9c49be859baa991f21dcdcf.exe	175fe32bf9c49be859baa991f21dcdcf.exe
PID 2012 wrote to memory of 2768	2012	175fe32bf9c49be859baa991f21dcdcf.exe	175fe32bf9c49be859baa991f21dcdcf.exe
PID 2012 wrote to memory of 2768	2012	175fe32bf9c49be859baa991f21dcdcf.exe	175fe32bf9c49be859baa991f21dcdcf.exe
PID 2012 wrote to memory of 2768	2012	175fe32bf9c49be859baa991f21dcdcf.exe	175fe32bf9c49be859baa991f21dcdcf.exe

C:\Users\Admin\AppData\Local\Temp\175fe32bf9c49be859baa991f21dcdcf.exe
"C:\Users\Admin\AppData\Local\Temp\175fe32bf9c49be859baa991f21dcdcf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\175fe32bf9c49be859baa991f21dcdcf.exe
  "{path}"
  2⤵
  PID:2768

memory/2012-17-0x0000000074920000-0x0000000074ECB000-memory.dmp

Filesize
5.7MB

Download
memory/2012-2-0x0000000074920000-0x0000000074ECB000-memory.dmp

Filesize
5.7MB

Download
memory/2012-0-0x0000000074920000-0x0000000074ECB000-memory.dmp

Filesize
5.7MB

Download
memory/2012-4-0x0000000000410000-0x0000000000450000-memory.dmp

Filesize
256KB

Download
memory/2012-3-0x0000000074920000-0x0000000074ECB000-memory.dmp

Filesize
5.7MB

Download
memory/2012-1-0x0000000000410000-0x0000000000450000-memory.dmp

Filesize
256KB

Download
memory/2768-14-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2768-16-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2768-18-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2768-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2768-11-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2768-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2768-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2768-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2768-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2768-19-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download