azorult | 737ff2b259449c91d68130a8508b51544310a6e6b50891fdc5682e7d242a79b4

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27-01-2024 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a6ef0f579b3c195bed6cf84b8861742.exe
Size

444KB
MD5

7a6ef0f579b3c195bed6cf84b8861742
SHA1

2498c1d5fe7c4794be18389d1cbb92f63d67c2ea
SHA256

737ff2b259449c91d68130a8508b51544310a6e6b50891fdc5682e7d242a79b4
SHA512

fff52d7b0610ecbe08f56e3548674ea8a5d70dce6a482d147e50464563d9e73512689acb812528f85eeb0496b11cf7d23181c96d7caf6bea5581a1e6b81d18ea
SSDEEP

6144:Fyk9Ml2Np2SJ6qzmiU+9P7TcWlWCLhhAtzQv1JeiqhNYZiWc9zwV6h1:02jJ62minP7llWCL0uve5NsbUwEh

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://208.167.239.179/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

7a6ef0f579b3c195bed6cf84b8861742.exe

description pid process target process

PID 2940 set thread context of 2664 2940 7a6ef0f579b3c195bed6cf84b8861742.exe 7a6ef0f579b3c195bed6cf84b8861742.exe

description	pid	process	target process
PID 2940 set thread context of 2664	2940	7a6ef0f579b3c195bed6cf84b8861742.exe	7a6ef0f579b3c195bed6cf84b8861742.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

7a6ef0f579b3c195bed6cf84b8861742.exe

description	pid	process	target process
PID 2940 wrote to memory of 2664	2940	7a6ef0f579b3c195bed6cf84b8861742.exe	7a6ef0f579b3c195bed6cf84b8861742.exe
PID 2940 wrote to memory of 2664	2940	7a6ef0f579b3c195bed6cf84b8861742.exe	7a6ef0f579b3c195bed6cf84b8861742.exe
PID 2940 wrote to memory of 2664	2940	7a6ef0f579b3c195bed6cf84b8861742.exe	7a6ef0f579b3c195bed6cf84b8861742.exe
PID 2940 wrote to memory of 2664	2940	7a6ef0f579b3c195bed6cf84b8861742.exe	7a6ef0f579b3c195bed6cf84b8861742.exe
PID 2940 wrote to memory of 2664	2940	7a6ef0f579b3c195bed6cf84b8861742.exe	7a6ef0f579b3c195bed6cf84b8861742.exe
PID 2940 wrote to memory of 2664	2940	7a6ef0f579b3c195bed6cf84b8861742.exe	7a6ef0f579b3c195bed6cf84b8861742.exe
PID 2940 wrote to memory of 2664	2940	7a6ef0f579b3c195bed6cf84b8861742.exe	7a6ef0f579b3c195bed6cf84b8861742.exe
PID 2940 wrote to memory of 2664	2940	7a6ef0f579b3c195bed6cf84b8861742.exe	7a6ef0f579b3c195bed6cf84b8861742.exe
PID 2940 wrote to memory of 2664	2940	7a6ef0f579b3c195bed6cf84b8861742.exe	7a6ef0f579b3c195bed6cf84b8861742.exe
PID 2940 wrote to memory of 2664	2940	7a6ef0f579b3c195bed6cf84b8861742.exe	7a6ef0f579b3c195bed6cf84b8861742.exe

C:\Users\Admin\AppData\Local\Temp\7a6ef0f579b3c195bed6cf84b8861742.exe
"C:\Users\Admin\AppData\Local\Temp\7a6ef0f579b3c195bed6cf84b8861742.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Users\Admin\AppData\Local\Temp\7a6ef0f579b3c195bed6cf84b8861742.exe
  "{path}"
  2⤵
  PID:2664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2664-18-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2664-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2664-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2664-23-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2664-12-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2664-22-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2664-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2664-14-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2664-20-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2664-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2940-4-0x0000000002090000-0x00000000020D0000-memory.dmp

Filesize
256KB

Download
memory/2940-0-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/2940-1-0x0000000002090000-0x00000000020D0000-memory.dmp

Filesize
256KB

Download
memory/2940-21-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/2940-2-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/2940-5-0x0000000002090000-0x00000000020D0000-memory.dmp

Filesize
256KB

Download
memory/2940-3-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download