azorult | 572219c5a55a6fd911cbb757de962043094a7d6d2f51a4e6f18c092a1bc4e07b

General

Target

15f48bc8803364e984d22700ea67f2b3.exe
Size

482KB
MD5

15f48bc8803364e984d22700ea67f2b3
SHA1

7662c9e1982d67959741b3aa72e153daeed7a4d6
SHA256

572219c5a55a6fd911cbb757de962043094a7d6d2f51a4e6f18c092a1bc4e07b
SHA512

8d2d0e1972fe8540473bf79041674d0056627b1764898f4b922d200d41ef4790fe38a14f5c4522654f5829da7b75bf6f353897ce1c432153d025da2d3aa2231b
SSDEEP

6144:vDKW1Lgbdl0TBBvjc/Iuky9xaMGMBenFAJQGXvYn7ot9s5ogfDWWpT7ONzYTd/Wx:rh1Lk70TnvjcHbGMBe8Vfs5Jpgx

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://37.0.10.99/PL341/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

15f48bc8803364e984d22700ea67f2b3.exe

description pid process target process

PID 4772 set thread context of 2600 4772 15f48bc8803364e984d22700ea67f2b3.exe cvTreS.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

15f48bc8803364e984d22700ea67f2b3.exe

pid process

4772 15f48bc8803364e984d22700ea67f2b3.exe
4772 15f48bc8803364e984d22700ea67f2b3.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

15f48bc8803364e984d22700ea67f2b3.exe

description pid process

Token: SeDebugPrivilege 4772 15f48bc8803364e984d22700ea67f2b3.exe

description	pid	process	target process
PID 4772 set thread context of 2600	4772	15f48bc8803364e984d22700ea67f2b3.exe	cvTreS.exe

pid	process
4772	15f48bc8803364e984d22700ea67f2b3.exe
4772	15f48bc8803364e984d22700ea67f2b3.exe

description	pid	process
Token: SeDebugPrivilege	4772	15f48bc8803364e984d22700ea67f2b3.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

15f48bc8803364e984d22700ea67f2b3.exe

description	pid	process	target process
PID 4772 wrote to memory of 4288	4772	15f48bc8803364e984d22700ea67f2b3.exe	cvTreS.exe
PID 4772 wrote to memory of 4288	4772	15f48bc8803364e984d22700ea67f2b3.exe	cvTreS.exe
PID 4772 wrote to memory of 4288	4772	15f48bc8803364e984d22700ea67f2b3.exe	cvTreS.exe
PID 4772 wrote to memory of 2600	4772	15f48bc8803364e984d22700ea67f2b3.exe	cvTreS.exe
PID 4772 wrote to memory of 2600	4772	15f48bc8803364e984d22700ea67f2b3.exe	cvTreS.exe
PID 4772 wrote to memory of 2600	4772	15f48bc8803364e984d22700ea67f2b3.exe	cvTreS.exe
PID 4772 wrote to memory of 2600	4772	15f48bc8803364e984d22700ea67f2b3.exe	cvTreS.exe
PID 4772 wrote to memory of 2600	4772	15f48bc8803364e984d22700ea67f2b3.exe	cvTreS.exe
PID 4772 wrote to memory of 2600	4772	15f48bc8803364e984d22700ea67f2b3.exe	cvTreS.exe
PID 4772 wrote to memory of 2600	4772	15f48bc8803364e984d22700ea67f2b3.exe	cvTreS.exe
PID 4772 wrote to memory of 2600	4772	15f48bc8803364e984d22700ea67f2b3.exe	cvTreS.exe
PID 4772 wrote to memory of 2600	4772	15f48bc8803364e984d22700ea67f2b3.exe	cvTreS.exe

C:\Users\Admin\AppData\Local\Temp\15f48bc8803364e984d22700ea67f2b3.exe
"C:\Users\Admin\AppData\Local\Temp\15f48bc8803364e984d22700ea67f2b3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvTreS.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvTreS.exe"
  2⤵
  PID:4288
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvTreS.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvTreS.exe"
  2⤵
  PID:2600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2600-45-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2600-51-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2600-48-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2600-47-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4772-21-0x0000000004D10000-0x0000000004D71000-memory.dmp

Filesize
388KB

Download
memory/4772-27-0x0000000004D10000-0x0000000004D71000-memory.dmp

Filesize
388KB

Download
memory/4772-6-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download
memory/4772-7-0x0000000004D10000-0x0000000004D76000-memory.dmp

Filesize
408KB

Download
memory/4772-8-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download
memory/4772-9-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download
memory/4772-10-0x0000000004D10000-0x0000000004D71000-memory.dmp

Filesize
388KB

Download
memory/4772-11-0x0000000004D10000-0x0000000004D71000-memory.dmp

Filesize
388KB

Download
memory/4772-13-0x0000000004D10000-0x0000000004D71000-memory.dmp

Filesize
388KB

Download
memory/4772-15-0x0000000004D10000-0x0000000004D71000-memory.dmp

Filesize
388KB

Download
memory/4772-17-0x0000000004D10000-0x0000000004D71000-memory.dmp

Filesize
388KB

Download
memory/4772-19-0x0000000004D10000-0x0000000004D71000-memory.dmp

Filesize
388KB

Download
memory/4772-0-0x00000000744E0000-0x0000000074C90000-memory.dmp

Filesize
7.7MB

Download
memory/4772-23-0x0000000004D10000-0x0000000004D71000-memory.dmp

Filesize
388KB

Download
memory/4772-25-0x0000000004D10000-0x0000000004D71000-memory.dmp

Filesize
388KB

Download
memory/4772-5-0x0000000004D90000-0x0000000005334000-memory.dmp

Filesize
5.6MB

Download
memory/4772-29-0x0000000004D10000-0x0000000004D71000-memory.dmp

Filesize
388KB

Download
memory/4772-31-0x0000000004D10000-0x0000000004D71000-memory.dmp

Filesize
388KB

Download
memory/4772-33-0x0000000004D10000-0x0000000004D71000-memory.dmp

Filesize
388KB

Download
memory/4772-35-0x0000000004D10000-0x0000000004D71000-memory.dmp

Filesize
388KB

Download
memory/4772-37-0x0000000004D10000-0x0000000004D71000-memory.dmp

Filesize
388KB

Download
memory/4772-39-0x0000000004D10000-0x0000000004D71000-memory.dmp

Filesize
388KB

Download
memory/4772-41-0x0000000004D10000-0x0000000004D71000-memory.dmp

Filesize
388KB

Download
memory/4772-43-0x0000000004D10000-0x0000000004D71000-memory.dmp

Filesize
388KB

Download
memory/4772-44-0x0000000000850000-0x00000000008EC000-memory.dmp

Filesize
624KB

Download
memory/4772-4-0x00000000744E0000-0x0000000074C90000-memory.dmp

Filesize
7.7MB

Download
memory/4772-3-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download
memory/4772-2-0x00000000024D0000-0x0000000002538000-memory.dmp

Filesize
416KB

Download
memory/4772-50-0x00000000744E0000-0x0000000074C90000-memory.dmp

Filesize
7.7MB

Download
memory/4772-1-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads