azorult | 3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2024 07:07

Target

3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe
Size

1.2MB
MD5

3c870efbe2e2350a62697a545d491a30
SHA1

5719ab24c8b5f26d7443d7eb7580c0661002697c
SHA256

3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a
SHA512

7caf7662234055b01e91b5b045b579214f037c0ecf5265ee1425019f4795b7a808dc2a7502e9ef3950702b7815a5dd4b44403d9e86549673e0271bbe57f46e49
SSDEEP

24576:zfsGRdrEAbm4zusGRdrEAbm4zbL3AfemsGRdrEAbm4zNYZg4pLw:DbdYAm4zubdYAm4z/3AXbdYAm4zNYZ1w

Score

10^/10

Family

azorult

https://5desconcertais.sa.com/cn/nem/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe

description	pid	process	target process
PID 3132 set thread context of 1860	3132	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe

pid process

3132 3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe

pid process

3132 3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe

pid	process
3132	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe

pid	process
3132	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe

description	pid	process	target process
PID 3132 wrote to memory of 1860	3132	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe
PID 3132 wrote to memory of 1860	3132	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe
PID 3132 wrote to memory of 1860	3132	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe
PID 3132 wrote to memory of 1860	3132	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe

C:\Users\Admin\AppData\Local\Temp\3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe
"C:\Users\Admin\AppData\Local\Temp\3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a.exe"
2⤵
PID:1860

memory/1860-5-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1860-7-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1860-9-0x0000000077202000-0x0000000077203000-memory.dmp

Filesize
4KB

Download
memory/1860-11-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1860-12-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1860-14-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3132-2-0x0000000077202000-0x0000000077203000-memory.dmp

Filesize
4KB

Download
memory/3132-3-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/3132-4-0x0000000002320000-0x0000000002328000-memory.dmp

Filesize
32KB

Download
memory/3132-10-0x0000000002320000-0x0000000002328000-memory.dmp

Filesize
32KB

Download