azorult | 342115e2b3702673e9f1baf63f0d801598b525b66388fd6af88a1a4666228482

Analysis

max time kernel
142s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 12:07

Target

180752c30cb36ad2320cdb74e36fb5a6.exe
Size

599KB
MD5

180752c30cb36ad2320cdb74e36fb5a6
SHA1

cdbc44d5365f4abaf6d093d6e78185370565f8a2
SHA256

342115e2b3702673e9f1baf63f0d801598b525b66388fd6af88a1a4666228482
SHA512

d2d653831e7c1c6eb054e9458e30a1635084dc32c996a52c745d959cf91b9e4813888e900c31adf4809dfc365560a47efde54c16a54cdb234abd447afdaa5d84
SSDEEP

6144:qX5Pj+glJePs7bnFto5+y4pAiKZ8MM8+3O:APj+gfKkbu+p6PZL+e

Score

10^/10

Family

azorult

http://outreach.zone/young/32/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

180752c30cb36ad2320cdb74e36fb5a6.exe

description pid process target process

PID 4348 set thread context of 1820 4348 180752c30cb36ad2320cdb74e36fb5a6.exe RegAsm.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

180752c30cb36ad2320cdb74e36fb5a6.exe

pid process

4348 180752c30cb36ad2320cdb74e36fb5a6.exe

description	pid	process	target process
PID 4348 set thread context of 1820	4348	180752c30cb36ad2320cdb74e36fb5a6.exe	RegAsm.exe

pid	process
4348	180752c30cb36ad2320cdb74e36fb5a6.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

180752c30cb36ad2320cdb74e36fb5a6.exe

description	pid	process	target process
PID 4348 wrote to memory of 1820	4348	180752c30cb36ad2320cdb74e36fb5a6.exe	RegAsm.exe
PID 4348 wrote to memory of 1820	4348	180752c30cb36ad2320cdb74e36fb5a6.exe	RegAsm.exe
PID 4348 wrote to memory of 1820	4348	180752c30cb36ad2320cdb74e36fb5a6.exe	RegAsm.exe
PID 4348 wrote to memory of 1820	4348	180752c30cb36ad2320cdb74e36fb5a6.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\180752c30cb36ad2320cdb74e36fb5a6.exe
"C:\Users\Admin\AppData\Local\Temp\180752c30cb36ad2320cdb74e36fb5a6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1820

memory/1820-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1820-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1820-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1820-14-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1820-12-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1820-18-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1820-16-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4348-1-0x0000000074E20000-0x00000000755D0000-memory.dmp

Filesize
7.7MB

Download
memory/4348-0-0x0000000000DE0000-0x0000000000E7C000-memory.dmp

Filesize
624KB

Download
memory/4348-2-0x0000000005760000-0x000000000578A000-memory.dmp

Filesize
168KB

Download
memory/4348-3-0x0000000005790000-0x0000000005793000-memory.dmp

Filesize
12KB

Download
memory/4348-8-0x0000000074E20000-0x00000000755D0000-memory.dmp

Filesize
7.7MB

Download