azorult | 342115e2b3702673e9f1baf63f0d801598b525b66388fd6af88a1a4666228482

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 10:42

Target

180752c30cb36ad2320cdb74e36fb5a6.exe
Size

599KB
MD5

180752c30cb36ad2320cdb74e36fb5a6
SHA1

cdbc44d5365f4abaf6d093d6e78185370565f8a2
SHA256

342115e2b3702673e9f1baf63f0d801598b525b66388fd6af88a1a4666228482
SHA512

d2d653831e7c1c6eb054e9458e30a1635084dc32c996a52c745d959cf91b9e4813888e900c31adf4809dfc365560a47efde54c16a54cdb234abd447afdaa5d84
SSDEEP

6144:qX5Pj+glJePs7bnFto5+y4pAiKZ8MM8+3O:APj+gfKkbu+p6PZL+e

Score

10^/10

Family

azorult

http://outreach.zone/young/32/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

180752c30cb36ad2320cdb74e36fb5a6.exe

description pid process target process

PID 2448 set thread context of 2420 2448 180752c30cb36ad2320cdb74e36fb5a6.exe RegAsm.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

180752c30cb36ad2320cdb74e36fb5a6.exe

pid process

2448 180752c30cb36ad2320cdb74e36fb5a6.exe

description	pid	process	target process
PID 2448 set thread context of 2420	2448	180752c30cb36ad2320cdb74e36fb5a6.exe	RegAsm.exe

pid	process
2448	180752c30cb36ad2320cdb74e36fb5a6.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

180752c30cb36ad2320cdb74e36fb5a6.exe

description	pid	process	target process
PID 2448 wrote to memory of 2420	2448	180752c30cb36ad2320cdb74e36fb5a6.exe	RegAsm.exe
PID 2448 wrote to memory of 2420	2448	180752c30cb36ad2320cdb74e36fb5a6.exe	RegAsm.exe
PID 2448 wrote to memory of 2420	2448	180752c30cb36ad2320cdb74e36fb5a6.exe	RegAsm.exe
PID 2448 wrote to memory of 2420	2448	180752c30cb36ad2320cdb74e36fb5a6.exe	RegAsm.exe
PID 2448 wrote to memory of 2420	2448	180752c30cb36ad2320cdb74e36fb5a6.exe	RegAsm.exe
PID 2448 wrote to memory of 2420	2448	180752c30cb36ad2320cdb74e36fb5a6.exe	RegAsm.exe
PID 2448 wrote to memory of 2420	2448	180752c30cb36ad2320cdb74e36fb5a6.exe	RegAsm.exe
PID 2448 wrote to memory of 2420	2448	180752c30cb36ad2320cdb74e36fb5a6.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\180752c30cb36ad2320cdb74e36fb5a6.exe
"C:\Users\Admin\AppData\Local\Temp\180752c30cb36ad2320cdb74e36fb5a6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2420

memory/2420-11-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2420-13-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2420-19-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2420-18-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2420-17-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2420-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2420-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2420-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2420-15-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2448-1-0x0000000073F70000-0x000000007465E000-memory.dmp

Filesize
6.9MB

Download
memory/2448-0-0x0000000000120000-0x00000000001BC000-memory.dmp

Filesize
624KB

Download
memory/2448-6-0x0000000073F70000-0x000000007465E000-memory.dmp

Filesize
6.9MB

Download
memory/2448-3-0x0000000000670000-0x0000000000673000-memory.dmp

Filesize
12KB

Download
memory/2448-2-0x0000000000640000-0x000000000066A000-memory.dmp

Filesize
168KB

Download