azorult | 120fcd098c502894515feb3814bd6edc34ceb13648dcfae2a22c4f4e2166ace2

Analysis

max time kernel
139s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-01-2024 22:34

Target

82be3b738b7b375f53a4bef3a37e4585.exe
Size

425KB
MD5

82be3b738b7b375f53a4bef3a37e4585
SHA1

417c1f005b106dbf326614ba4ac9c41c83abb267
SHA256

120fcd098c502894515feb3814bd6edc34ceb13648dcfae2a22c4f4e2166ace2
SHA512

fd0657dd8544c7cb4cbada98bc8c11719f0e9fbdf48fa3aed9f566f07c7478faec0c90a4a267475ec9a4c88e0663a7279f9479aede596f92e7f79e3e27595a0f
SSDEEP

12288:Xd53TvpHeIl0MoX8t0CPARBp0xm0ltBBm1ccBFJL6:Xd53TvpHeIl058CoART0w0ltBBecOL6

Score

10^/10

Family

azorult

http://37.0.8.80/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

82be3b738b7b375f53a4bef3a37e4585.exe

description pid process target process

PID 4140 set thread context of 1772 4140 82be3b738b7b375f53a4bef3a37e4585.exe 82be3b738b7b375f53a4bef3a37e4585.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

82be3b738b7b375f53a4bef3a37e4585.exe

pid process

4140 82be3b738b7b375f53a4bef3a37e4585.exe

description	pid	process	target process
PID 4140 set thread context of 1772	4140	82be3b738b7b375f53a4bef3a37e4585.exe	82be3b738b7b375f53a4bef3a37e4585.exe

pid	process
4140	82be3b738b7b375f53a4bef3a37e4585.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

82be3b738b7b375f53a4bef3a37e4585.exe

description	pid	process	target process
PID 4140 wrote to memory of 1772	4140	82be3b738b7b375f53a4bef3a37e4585.exe	82be3b738b7b375f53a4bef3a37e4585.exe
PID 4140 wrote to memory of 1772	4140	82be3b738b7b375f53a4bef3a37e4585.exe	82be3b738b7b375f53a4bef3a37e4585.exe
PID 4140 wrote to memory of 1772	4140	82be3b738b7b375f53a4bef3a37e4585.exe	82be3b738b7b375f53a4bef3a37e4585.exe
PID 4140 wrote to memory of 1772	4140	82be3b738b7b375f53a4bef3a37e4585.exe	82be3b738b7b375f53a4bef3a37e4585.exe

C:\Users\Admin\AppData\Local\Temp\82be3b738b7b375f53a4bef3a37e4585.exe
"C:\Users\Admin\AppData\Local\Temp\82be3b738b7b375f53a4bef3a37e4585.exe"
2⤵
PID:1772

memory/1772-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1772-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1772-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1772-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4140-1-0x00000000000A0000-0x00000000001A0000-memory.dmp

Filesize
1024KB

Download
memory/4140-2-0x0000000000A00000-0x0000000000A02000-memory.dmp

Filesize
8KB

Download