azorult | 96ef205b273f3f89847c788c9b63797a5fcf899c4b25106f7a21ab57311e4c2a

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 12:32

Target

1ea32dddabc7401fa9f12e5f4c01c209.exe
Size

399KB
MD5

1ea32dddabc7401fa9f12e5f4c01c209
SHA1

f69624baab8c14252db2acc17d6f83ba111e6d72
SHA256

96ef205b273f3f89847c788c9b63797a5fcf899c4b25106f7a21ab57311e4c2a
SHA512

6f88a3c69987371179c92f3a4e532468b466c133ff465569de9308c5e7ae45c3a2a1e9efe7acbe72c9e0088e036032cb30a1e412e7c9f0b2750e007165edf544
SSDEEP

12288:0Z4SZt7Ru5igkb6Beigj+YGpvLrY9c3UbzeP6:dEttu5igk+BMiYGpPNUN

Score

10^/10

Family

azorult

http://spreadgoodfiles.xyz/XcvU/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

1ea32dddabc7401fa9f12e5f4c01c209.exe

description pid process target process

PID 4092 set thread context of 1648 4092 1ea32dddabc7401fa9f12e5f4c01c209.exe 1ea32dddabc7401fa9f12e5f4c01c209.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

1ea32dddabc7401fa9f12e5f4c01c209.exe

pid process

4092 1ea32dddabc7401fa9f12e5f4c01c209.exe

description	pid	process	target process
PID 4092 set thread context of 1648	4092	1ea32dddabc7401fa9f12e5f4c01c209.exe	1ea32dddabc7401fa9f12e5f4c01c209.exe

pid	process
4092	1ea32dddabc7401fa9f12e5f4c01c209.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1ea32dddabc7401fa9f12e5f4c01c209.exe

description	pid	process	target process
PID 4092 wrote to memory of 1648	4092	1ea32dddabc7401fa9f12e5f4c01c209.exe	1ea32dddabc7401fa9f12e5f4c01c209.exe
PID 4092 wrote to memory of 1648	4092	1ea32dddabc7401fa9f12e5f4c01c209.exe	1ea32dddabc7401fa9f12e5f4c01c209.exe
PID 4092 wrote to memory of 1648	4092	1ea32dddabc7401fa9f12e5f4c01c209.exe	1ea32dddabc7401fa9f12e5f4c01c209.exe
PID 4092 wrote to memory of 1648	4092	1ea32dddabc7401fa9f12e5f4c01c209.exe	1ea32dddabc7401fa9f12e5f4c01c209.exe

C:\Users\Admin\AppData\Local\Temp\1ea32dddabc7401fa9f12e5f4c01c209.exe
"C:\Users\Admin\AppData\Local\Temp\1ea32dddabc7401fa9f12e5f4c01c209.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Users\Admin\AppData\Local\Temp\1ea32dddabc7401fa9f12e5f4c01c209.exe
  "C:\Users\Admin\AppData\Local\Temp\1ea32dddabc7401fa9f12e5f4c01c209.exe"
  2⤵
  PID:1648

memory/1648-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1648-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1648-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1648-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4092-0-0x0000000000CF0000-0x0000000000D25000-memory.dmp

Filesize
212KB

Download
memory/4092-1-0x00000000005C0000-0x00000000005C2000-memory.dmp

Filesize
8KB

Download