azorult | 342115e2b3702673e9f1baf63f0d801598b525b66388fd6af88a1a4666228482

Analysis

max time kernel
93s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 10:42

Target

180752c30cb36ad2320cdb74e36fb5a6.exe
Size

599KB
MD5

180752c30cb36ad2320cdb74e36fb5a6
SHA1

cdbc44d5365f4abaf6d093d6e78185370565f8a2
SHA256

342115e2b3702673e9f1baf63f0d801598b525b66388fd6af88a1a4666228482
SHA512

d2d653831e7c1c6eb054e9458e30a1635084dc32c996a52c745d959cf91b9e4813888e900c31adf4809dfc365560a47efde54c16a54cdb234abd447afdaa5d84
SSDEEP

6144:qX5Pj+glJePs7bnFto5+y4pAiKZ8MM8+3O:APj+gfKkbu+p6PZL+e

Score

10^/10

Family

azorult

http://outreach.zone/young/32/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

180752c30cb36ad2320cdb74e36fb5a6.exe

description pid process target process

PID 8 set thread context of 1616 8 180752c30cb36ad2320cdb74e36fb5a6.exe RegAsm.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

180752c30cb36ad2320cdb74e36fb5a6.exe

pid process

8 180752c30cb36ad2320cdb74e36fb5a6.exe

description	pid	process	target process
PID 8 set thread context of 1616	8	180752c30cb36ad2320cdb74e36fb5a6.exe	RegAsm.exe

pid	process
8	180752c30cb36ad2320cdb74e36fb5a6.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

180752c30cb36ad2320cdb74e36fb5a6.exe

description	pid	process	target process
PID 8 wrote to memory of 1616	8	180752c30cb36ad2320cdb74e36fb5a6.exe	RegAsm.exe
PID 8 wrote to memory of 1616	8	180752c30cb36ad2320cdb74e36fb5a6.exe	RegAsm.exe
PID 8 wrote to memory of 1616	8	180752c30cb36ad2320cdb74e36fb5a6.exe	RegAsm.exe
PID 8 wrote to memory of 1616	8	180752c30cb36ad2320cdb74e36fb5a6.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\180752c30cb36ad2320cdb74e36fb5a6.exe
"C:\Users\Admin\AppData\Local\Temp\180752c30cb36ad2320cdb74e36fb5a6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1616

memory/8-1-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/8-0-0x0000000000D90000-0x0000000000E2C000-memory.dmp

Filesize
624KB

Download
memory/8-2-0x00000000031C0000-0x00000000031EA000-memory.dmp

Filesize
168KB

Download
memory/8-5-0x0000000005740000-0x0000000005743000-memory.dmp

Filesize
12KB

Download
memory/8-7-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/1616-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1616-18-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1616-16-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1616-14-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1616-12-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1616-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1616-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download