azorult | 3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02-02-2024 07:07

Target

3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe
Size

1.2MB
MD5

3c870efbe2e2350a62697a545d491a30
SHA1

5719ab24c8b5f26d7443d7eb7580c0661002697c
SHA256

3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a
SHA512

7caf7662234055b01e91b5b045b579214f037c0ecf5265ee1425019f4795b7a808dc2a7502e9ef3950702b7815a5dd4b44403d9e86549673e0271bbe57f46e49
SSDEEP

24576:zfsGRdrEAbm4zusGRdrEAbm4zbL3AfemsGRdrEAbm4zNYZg4pLw:DbdYAm4zubdYAm4z/3AXbdYAm4zNYZ1w

Score

10^/10

Family

azorult

https://5desconcertais.sa.com/cn/nem/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe

description	pid	process	target process
PID 2508 set thread context of 2216	2508	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe

pid process

2508 3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe

pid process

2508 3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe

pid	process
2508	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe

pid	process
2508	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe

description	pid	process	target process
PID 2508 wrote to memory of 2216	2508	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe
PID 2508 wrote to memory of 2216	2508	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe
PID 2508 wrote to memory of 2216	2508	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe
PID 2508 wrote to memory of 2216	2508	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe
PID 2508 wrote to memory of 2216	2508	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe

C:\Users\Admin\AppData\Local\Temp\3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe
"C:\Users\Admin\AppData\Local\Temp\3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Users\Admin\AppData\Local\Temp\3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe
  "C:\Users\Admin\AppData\Local\Temp\3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe"
  2⤵
  PID:2216

memory/2216-4-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2216-7-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2216-9-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2216-10-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2216-11-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2216-13-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2508-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2508-3-0x0000000000290000-0x0000000000298000-memory.dmp

Filesize
32KB

Download
memory/2508-5-0x0000000000290000-0x0000000000298000-memory.dmp

Filesize
32KB

Download