azorult | cd6587c12a8925cbb9d354e9d019d5e0adced686238a40a17c294305d6b93cb4

Analysis

max time kernel
5s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02-01-2024 15:18

Target

8cb8a392ab4594e4be5f939fde2581be.exe
Size

721KB
MD5

8cb8a392ab4594e4be5f939fde2581be
SHA1

fdab49a13212672e419c867c4a8f536c32457fd9
SHA256

cd6587c12a8925cbb9d354e9d019d5e0adced686238a40a17c294305d6b93cb4
SHA512

630c0f27f79f6aceb7ea98f28c0125960ae434e12ecd87a69f407ff48d40f0da95ded3709b10de796ebe4c2c25ec5486f540e44898c5be077d05015fed75b5e7
SSDEEP

12288:DquErHF6xC9D6DmR1J98w4oknqOKw/zTd1RVaHvymUi6rjXrm62iU952aLovi756:arl6kD68JmloO7TdNaPymUi63i62xHLW

Score

10^/10

Family

azorult

http://185.79.156.23/j0n0/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1620-0-0x0000000000C60000-0x0000000000DF4000-memory.dmp	upx
behavioral1/memory/1620-25-0x0000000000C60000-0x0000000000DF4000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

8cb8a392ab4594e4be5f939fde2581be.exe

description pid process target process

PID 1620 set thread context of 2964 1620 8cb8a392ab4594e4be5f939fde2581be.exe RegAsm.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2760 timeout.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

8cb8a392ab4594e4be5f939fde2581be.exe

pid process

1620 8cb8a392ab4594e4be5f939fde2581be.exe
1620 8cb8a392ab4594e4be5f939fde2581be.exe
1620 8cb8a392ab4594e4be5f939fde2581be.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

8cb8a392ab4594e4be5f939fde2581be.exe

pid process

1620 8cb8a392ab4594e4be5f939fde2581be.exe
1620 8cb8a392ab4594e4be5f939fde2581be.exe
1620 8cb8a392ab4594e4be5f939fde2581be.exe

description	pid	process	target process
PID 1620 set thread context of 2964	1620	8cb8a392ab4594e4be5f939fde2581be.exe	RegAsm.exe

pid	process
2760	timeout.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

8cb8a392ab4594e4be5f939fde2581be.exe

description	pid	process	target process
PID 1620 wrote to memory of 2964	1620	8cb8a392ab4594e4be5f939fde2581be.exe	RegAsm.exe
PID 1620 wrote to memory of 2964	1620	8cb8a392ab4594e4be5f939fde2581be.exe	RegAsm.exe
PID 1620 wrote to memory of 2964	1620	8cb8a392ab4594e4be5f939fde2581be.exe	RegAsm.exe
PID 1620 wrote to memory of 2964	1620	8cb8a392ab4594e4be5f939fde2581be.exe	RegAsm.exe
PID 1620 wrote to memory of 2964	1620	8cb8a392ab4594e4be5f939fde2581be.exe	RegAsm.exe
PID 1620 wrote to memory of 2964	1620	8cb8a392ab4594e4be5f939fde2581be.exe	RegAsm.exe
PID 1620 wrote to memory of 2964	1620	8cb8a392ab4594e4be5f939fde2581be.exe	RegAsm.exe
PID 1620 wrote to memory of 2964	1620	8cb8a392ab4594e4be5f939fde2581be.exe	RegAsm.exe
PID 1620 wrote to memory of 2964	1620	8cb8a392ab4594e4be5f939fde2581be.exe	RegAsm.exe
PID 1620 wrote to memory of 2864	1620	8cb8a392ab4594e4be5f939fde2581be.exe	cmd.exe
PID 1620 wrote to memory of 2864	1620	8cb8a392ab4594e4be5f939fde2581be.exe	cmd.exe
PID 1620 wrote to memory of 2864	1620	8cb8a392ab4594e4be5f939fde2581be.exe	cmd.exe
PID 1620 wrote to memory of 2864	1620	8cb8a392ab4594e4be5f939fde2581be.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\8cb8a392ab4594e4be5f939fde2581be.exe
"C:\Users\Admin\AppData\Local\Temp\8cb8a392ab4594e4be5f939fde2581be.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:2964
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c TimeOut 1 & Del /F "C:\Users\Admin\AppData\Local\Temp\8cb8a392ab4594e4be5f939fde2581be.exe"
  2⤵
  PID:2864

C:\Windows\SysWOW64\timeout.exe
TimeOut 1
1⤵
- Delays execution with timeout.exe
PID:2760

memory/1620-0-0x0000000000C60000-0x0000000000DF4000-memory.dmp

Filesize
1.6MB

Download
memory/1620-3-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1620-25-0x0000000000C60000-0x0000000000DF4000-memory.dmp

Filesize
1.6MB

Download
memory/2964-14-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2964-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2964-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2964-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2964-24-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2964-22-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2964-20-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2964-18-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2964-16-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download