azorult | f73579603fda08d484fd111ba5c0f00ea57d25c79365608995dedb0cd037c66b

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-02-2024 16:14

Target

a438c81e4e428cc0710aa97a37fdb383.exe
Size

659KB
MD5

a438c81e4e428cc0710aa97a37fdb383
SHA1

0aaeb01eaf1228a94233ec0a1d25957a291994f0
SHA256

f73579603fda08d484fd111ba5c0f00ea57d25c79365608995dedb0cd037c66b
SHA512

b82093d9e31f5bc1eeec158156be6bb0db9fb22533ce362c6052c5d816be12f066cb5ca0ebe22b9f011bac27ff2b6010134549cb635254f3ab3b95c557aed921
SSDEEP

12288:Y1aeNUlfdUmfGhV93GTCs55rR5itbZ3EO1I4ObYF1YZK8f+OVpdgd+ZfM:YkeckPWTV55rWFUO

Score

10^/10

Family

azorult

http://208.167.239.179/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

a438c81e4e428cc0710aa97a37fdb383.exe

description pid process target process

PID 2100 set thread context of 2672 2100 a438c81e4e428cc0710aa97a37fdb383.exe a438c81e4e428cc0710aa97a37fdb383.exe

description	pid	process	target process
PID 2100 set thread context of 2672	2100	a438c81e4e428cc0710aa97a37fdb383.exe	a438c81e4e428cc0710aa97a37fdb383.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

a438c81e4e428cc0710aa97a37fdb383.exe

description	pid	process	target process
PID 2100 wrote to memory of 2672	2100	a438c81e4e428cc0710aa97a37fdb383.exe	a438c81e4e428cc0710aa97a37fdb383.exe
PID 2100 wrote to memory of 2672	2100	a438c81e4e428cc0710aa97a37fdb383.exe	a438c81e4e428cc0710aa97a37fdb383.exe
PID 2100 wrote to memory of 2672	2100	a438c81e4e428cc0710aa97a37fdb383.exe	a438c81e4e428cc0710aa97a37fdb383.exe
PID 2100 wrote to memory of 2672	2100	a438c81e4e428cc0710aa97a37fdb383.exe	a438c81e4e428cc0710aa97a37fdb383.exe
PID 2100 wrote to memory of 2672	2100	a438c81e4e428cc0710aa97a37fdb383.exe	a438c81e4e428cc0710aa97a37fdb383.exe
PID 2100 wrote to memory of 2672	2100	a438c81e4e428cc0710aa97a37fdb383.exe	a438c81e4e428cc0710aa97a37fdb383.exe
PID 2100 wrote to memory of 2672	2100	a438c81e4e428cc0710aa97a37fdb383.exe	a438c81e4e428cc0710aa97a37fdb383.exe
PID 2100 wrote to memory of 2672	2100	a438c81e4e428cc0710aa97a37fdb383.exe	a438c81e4e428cc0710aa97a37fdb383.exe
PID 2100 wrote to memory of 2672	2100	a438c81e4e428cc0710aa97a37fdb383.exe	a438c81e4e428cc0710aa97a37fdb383.exe
PID 2100 wrote to memory of 2672	2100	a438c81e4e428cc0710aa97a37fdb383.exe	a438c81e4e428cc0710aa97a37fdb383.exe

C:\Users\Admin\AppData\Local\Temp\a438c81e4e428cc0710aa97a37fdb383.exe
"C:\Users\Admin\AppData\Local\Temp\a438c81e4e428cc0710aa97a37fdb383.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\a438c81e4e428cc0710aa97a37fdb383.exe
  "{path}"
  2⤵
  PID:2672

memory/2100-20-0x0000000074100000-0x00000000746AB000-memory.dmp

Filesize
5.7MB

Download
memory/2100-1-0x0000000074100000-0x00000000746AB000-memory.dmp

Filesize
5.7MB

Download
memory/2100-2-0x0000000000A50000-0x0000000000A90000-memory.dmp

Filesize
256KB

Download
memory/2100-3-0x0000000074100000-0x00000000746AB000-memory.dmp

Filesize
5.7MB

Download
memory/2100-0-0x0000000074100000-0x00000000746AB000-memory.dmp

Filesize
5.7MB

Download
memory/2100-4-0x0000000000A50000-0x0000000000A90000-memory.dmp

Filesize
256KB

Download
memory/2672-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2672-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2672-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2672-13-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2672-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2672-17-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2672-11-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2672-19-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2672-21-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2672-22-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download