azorult | 22a117c101443073379635cf75a22acfaa3dcc65c29bde65a3287d177147f2e1

Analysis

max time kernel
80s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2024 22:46

Target

7b7c13961dd5633dbd63837ba08aaed7.exe
Size

720KB
MD5

7b7c13961dd5633dbd63837ba08aaed7
SHA1

e6c7f08a005b4f195cf1f0ac024442157dc0e8c0
SHA256

22a117c101443073379635cf75a22acfaa3dcc65c29bde65a3287d177147f2e1
SHA512

0875f202878e0a9a79adf5ea97f310b1b50b562c1bfcd0644164847b32369833df4f1228b9d7c9fb431fa0d9b7915374f2d8c952ca04aa1eaf0ee34ad30b39b5
SSDEEP

12288:XrMBoA6sOVrlU3LcedGUGnTsbArC9Vo93uFsIWRiseXubEst98B4p7UWr4:XrMrcedrSTs8m9VVWRisEs78B4pjr4

Score

10^/10

Family

azorult

http://cwownola.org/AqwE/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

7b7c13961dd5633dbd63837ba08aaed7.exe

description pid process target process

PID 4844 set thread context of 1740 4844 7b7c13961dd5633dbd63837ba08aaed7.exe 7b7c13961dd5633dbd63837ba08aaed7.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3768 1740 WerFault.exe 7b7c13961dd5633dbd63837ba08aaed7.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

7b7c13961dd5633dbd63837ba08aaed7.exe

pid process

4844 7b7c13961dd5633dbd63837ba08aaed7.exe

description	pid	process	target process
PID 4844 set thread context of 1740	4844	7b7c13961dd5633dbd63837ba08aaed7.exe	7b7c13961dd5633dbd63837ba08aaed7.exe

pid	pid_target	process	target process
3768	1740	WerFault.exe	7b7c13961dd5633dbd63837ba08aaed7.exe

pid	process
4844	7b7c13961dd5633dbd63837ba08aaed7.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7b7c13961dd5633dbd63837ba08aaed7.exe

description	pid	process	target process
PID 4844 wrote to memory of 1740	4844	7b7c13961dd5633dbd63837ba08aaed7.exe	7b7c13961dd5633dbd63837ba08aaed7.exe
PID 4844 wrote to memory of 1740	4844	7b7c13961dd5633dbd63837ba08aaed7.exe	7b7c13961dd5633dbd63837ba08aaed7.exe
PID 4844 wrote to memory of 1740	4844	7b7c13961dd5633dbd63837ba08aaed7.exe	7b7c13961dd5633dbd63837ba08aaed7.exe
PID 4844 wrote to memory of 1740	4844	7b7c13961dd5633dbd63837ba08aaed7.exe	7b7c13961dd5633dbd63837ba08aaed7.exe

C:\Users\Admin\AppData\Local\Temp\7b7c13961dd5633dbd63837ba08aaed7.exe
"C:\Users\Admin\AppData\Local\Temp\7b7c13961dd5633dbd63837ba08aaed7.exe"
2⤵
PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 1800
3⤵
- Program crash
PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1740 -ip 1740
1⤵
PID:4736

memory/1740-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1740-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1740-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1740-15-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4844-1-0x0000000001000000-0x0000000001100000-memory.dmp

Filesize
1024KB

Download
memory/4844-2-0x00000000013F0000-0x00000000013F2000-memory.dmp

Filesize
8KB

Download