azorult | 23722503bdcc20ab9e6482bb2d3e92e50b13443799f361975bb36a91f0eeb895

General

Target

Iz{$_owt)[.exe
Size

717KB
MD5

ec88a4c1dcfb3861f6c9c364deeabd94
SHA1

ed0d81e041345ddc9ff9fea8bad197ee1a66fe82
SHA256

23722503bdcc20ab9e6482bb2d3e92e50b13443799f361975bb36a91f0eeb895
SHA512

81f6ed64f54778aa59afbc515dd6a40b5acac397348801dadbddcfdc15711144c3085e08099ba2a28a98055039916ade0e0cde1ea6fcf78b1f5962e8651609a7
SSDEEP

12288:rtHCL6YFXDk8fwYXzlRLf3AM+lsEttF2s9NgztG2Qk/sxJhT:xHq6Y5hRLsGEvF2sOtGkIh

Score

10^/10

azorult zgrat infostealer rat trojan

Malware Config

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4616-4-0x0000000005330000-0x00000000053D4000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-5-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-6-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-8-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-10-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-12-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-14-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-16-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-18-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-20-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-22-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-24-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-26-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-28-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-30-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-32-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-34-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-36-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-38-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-40-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-42-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-44-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-46-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-48-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-50-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-52-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-54-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-56-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-58-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-60-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-62-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-64-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-66-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-68-0x0000000005330000-0x00000000053CE000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Suspicious use of SetThreadContext 1 IoCs

Processes:

Iz{$_owt)[.exe

description pid process target process

PID 4616 set thread context of 4888 4616 Iz{$_owt)[.exe Iz{$_owt)[.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Iz{$_owt)[.exe

description pid process

Token: SeDebugPrivilege 4616 Iz{$_owt)[.exe

description	pid	process	target process
PID 4616 set thread context of 4888	4616	Iz{$_owt)[.exe	Iz{$_owt)[.exe

description	pid	process
Token: SeDebugPrivilege	4616	Iz{$_owt)[.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Iz{$_owt)[.exe

description	pid	process	target process
PID 4616 wrote to memory of 4888	4616	Iz{$_owt)[.exe	Iz{$_owt)[.exe
PID 4616 wrote to memory of 4888	4616	Iz{$_owt)[.exe	Iz{$_owt)[.exe
PID 4616 wrote to memory of 4888	4616	Iz{$_owt)[.exe	Iz{$_owt)[.exe
PID 4616 wrote to memory of 4888	4616	Iz{$_owt)[.exe	Iz{$_owt)[.exe
PID 4616 wrote to memory of 4888	4616	Iz{$_owt)[.exe	Iz{$_owt)[.exe
PID 4616 wrote to memory of 4888	4616	Iz{$_owt)[.exe	Iz{$_owt)[.exe
PID 4616 wrote to memory of 4888	4616	Iz{$_owt)[.exe	Iz{$_owt)[.exe
PID 4616 wrote to memory of 4888	4616	Iz{$_owt)[.exe	Iz{$_owt)[.exe
PID 4616 wrote to memory of 4888	4616	Iz{$_owt)[.exe	Iz{$_owt)[.exe

C:\Users\Admin\AppData\Local\Temp\Iz{$_owt)[.exe
"C:\Users\Admin\AppData\Local\Temp\Iz{$_owt)[.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616

C:\Users\Admin\AppData\Local\Temp\Iz{$_owt)[.exe
C:\Users\Admin\AppData\Local\Temp\Iz{$_owt)[.exe
2⤵
PID:4888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4616-38-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-946-0x0000000074C80000-0x0000000075430000-memory.dmp

Filesize
7.7MB

Download
memory/4616-2-0x00000000052B0000-0x00000000052C0000-memory.dmp

Filesize
64KB

Download
memory/4616-0-0x00000000007C0000-0x000000000087A000-memory.dmp

Filesize
744KB

Download
memory/4616-4-0x0000000005330000-0x00000000053D4000-memory.dmp

Filesize
656KB

Download
memory/4616-5-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-6-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-8-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-10-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-12-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-14-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-16-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-18-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-20-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-22-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-24-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-26-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-42-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-30-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-32-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-34-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-36-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-3-0x00000000051E0000-0x0000000005282000-memory.dmp

Filesize
648KB

Download
memory/4616-1-0x0000000074C80000-0x0000000075430000-memory.dmp

Filesize
7.7MB

Download
memory/4616-28-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-44-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-46-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-48-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-50-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-52-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-54-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-56-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-58-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-60-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-62-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-64-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-66-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-68-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4616-937-0x0000000001400000-0x0000000001401000-memory.dmp

Filesize
4KB

Download
memory/4616-938-0x00000000053D0000-0x000000000540C000-memory.dmp

Filesize
240KB

Download
memory/4616-939-0x0000000005410000-0x000000000545C000-memory.dmp

Filesize
304KB

Download
memory/4616-940-0x0000000005E10000-0x00000000063B4000-memory.dmp

Filesize
5.6MB

Download
memory/4616-40-0x0000000005330000-0x00000000053CE000-memory.dmp

Filesize
632KB

Download
memory/4888-945-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4888-947-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads