azorult | f73579603fda08d484fd111ba5c0f00ea57d25c79365608995dedb0cd037c66b

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25-02-2024 16:14

Target

a438c81e4e428cc0710aa97a37fdb383.exe
Size

659KB
MD5

a438c81e4e428cc0710aa97a37fdb383
SHA1

0aaeb01eaf1228a94233ec0a1d25957a291994f0
SHA256

f73579603fda08d484fd111ba5c0f00ea57d25c79365608995dedb0cd037c66b
SHA512

b82093d9e31f5bc1eeec158156be6bb0db9fb22533ce362c6052c5d816be12f066cb5ca0ebe22b9f011bac27ff2b6010134549cb635254f3ab3b95c557aed921
SSDEEP

12288:Y1aeNUlfdUmfGhV93GTCs55rR5itbZ3EO1I4ObYF1YZK8f+OVpdgd+ZfM:YkeckPWTV55rWFUO

Score

10^/10

Family

azorult

http://208.167.239.179/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

a438c81e4e428cc0710aa97a37fdb383.exe

description pid process target process

PID 1432 set thread context of 392 1432 a438c81e4e428cc0710aa97a37fdb383.exe a438c81e4e428cc0710aa97a37fdb383.exe

description	pid	process	target process
PID 1432 set thread context of 392	1432	a438c81e4e428cc0710aa97a37fdb383.exe	a438c81e4e428cc0710aa97a37fdb383.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a438c81e4e428cc0710aa97a37fdb383.exe

description	pid	process	target process
PID 1432 wrote to memory of 392	1432	a438c81e4e428cc0710aa97a37fdb383.exe	a438c81e4e428cc0710aa97a37fdb383.exe
PID 1432 wrote to memory of 392	1432	a438c81e4e428cc0710aa97a37fdb383.exe	a438c81e4e428cc0710aa97a37fdb383.exe
PID 1432 wrote to memory of 392	1432	a438c81e4e428cc0710aa97a37fdb383.exe	a438c81e4e428cc0710aa97a37fdb383.exe
PID 1432 wrote to memory of 392	1432	a438c81e4e428cc0710aa97a37fdb383.exe	a438c81e4e428cc0710aa97a37fdb383.exe
PID 1432 wrote to memory of 392	1432	a438c81e4e428cc0710aa97a37fdb383.exe	a438c81e4e428cc0710aa97a37fdb383.exe
PID 1432 wrote to memory of 392	1432	a438c81e4e428cc0710aa97a37fdb383.exe	a438c81e4e428cc0710aa97a37fdb383.exe
PID 1432 wrote to memory of 392	1432	a438c81e4e428cc0710aa97a37fdb383.exe	a438c81e4e428cc0710aa97a37fdb383.exe
PID 1432 wrote to memory of 392	1432	a438c81e4e428cc0710aa97a37fdb383.exe	a438c81e4e428cc0710aa97a37fdb383.exe
PID 1432 wrote to memory of 392	1432	a438c81e4e428cc0710aa97a37fdb383.exe	a438c81e4e428cc0710aa97a37fdb383.exe

C:\Users\Admin\AppData\Local\Temp\a438c81e4e428cc0710aa97a37fdb383.exe
"C:\Users\Admin\AppData\Local\Temp\a438c81e4e428cc0710aa97a37fdb383.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Users\Admin\AppData\Local\Temp\a438c81e4e428cc0710aa97a37fdb383.exe
  "{path}"
  2⤵
  PID:392

memory/392-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/392-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/392-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/392-11-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1432-0-0x0000000075250000-0x0000000075801000-memory.dmp

Filesize
5.7MB

Download
memory/1432-1-0x0000000075250000-0x0000000075801000-memory.dmp

Filesize
5.7MB

Download
memory/1432-2-0x0000000001090000-0x00000000010A0000-memory.dmp

Filesize
64KB

Download
memory/1432-3-0x0000000075250000-0x0000000075801000-memory.dmp

Filesize
5.7MB

Download
memory/1432-4-0x0000000001090000-0x00000000010A0000-memory.dmp

Filesize
64KB

Download
memory/1432-10-0x0000000075250000-0x0000000075801000-memory.dmp

Filesize
5.7MB

Download