azorult | 98731563833b5df1e16acbc3fc3033f5d05c4c7d35cc0eab5d2a0d5bb2fb3a3e

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-02-2024 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a51be555c96c608f897f8d5fb8b291a0.exe
Size

824KB
MD5

a51be555c96c608f897f8d5fb8b291a0
SHA1

e03dc375b737cb85b5a97210a9fb91086120462d
SHA256

98731563833b5df1e16acbc3fc3033f5d05c4c7d35cc0eab5d2a0d5bb2fb3a3e
SHA512

997b5caf294887461d304a8f1307adb952ba03848fc587fa5ac26dfa26353b052cdb70812b39e54159b63afa49055a831ab2931f05cb44a8a35a373e8cb9aef3
SSDEEP

12288:nPEp+gczyhNSvRbBQHR4qz91hI0zSaNsvz+yuWDVId21NaI+E8tyvXLdBxeQTYuL:Ppdj7os9s48gu4tEsFnoGLmlXB

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://45.77.188.26/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

a51be555c96c608f897f8d5fb8b291a0.exe

description pid process target process

PID 2208 set thread context of 2744 2208 a51be555c96c608f897f8d5fb8b291a0.exe a51be555c96c608f897f8d5fb8b291a0.exe

description	pid	process	target process
PID 2208 set thread context of 2744	2208	a51be555c96c608f897f8d5fb8b291a0.exe	a51be555c96c608f897f8d5fb8b291a0.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

a51be555c96c608f897f8d5fb8b291a0.exe

description	pid	process	target process
PID 2208 wrote to memory of 2744	2208	a51be555c96c608f897f8d5fb8b291a0.exe	a51be555c96c608f897f8d5fb8b291a0.exe
PID 2208 wrote to memory of 2744	2208	a51be555c96c608f897f8d5fb8b291a0.exe	a51be555c96c608f897f8d5fb8b291a0.exe
PID 2208 wrote to memory of 2744	2208	a51be555c96c608f897f8d5fb8b291a0.exe	a51be555c96c608f897f8d5fb8b291a0.exe
PID 2208 wrote to memory of 2744	2208	a51be555c96c608f897f8d5fb8b291a0.exe	a51be555c96c608f897f8d5fb8b291a0.exe
PID 2208 wrote to memory of 2744	2208	a51be555c96c608f897f8d5fb8b291a0.exe	a51be555c96c608f897f8d5fb8b291a0.exe
PID 2208 wrote to memory of 2744	2208	a51be555c96c608f897f8d5fb8b291a0.exe	a51be555c96c608f897f8d5fb8b291a0.exe
PID 2208 wrote to memory of 2744	2208	a51be555c96c608f897f8d5fb8b291a0.exe	a51be555c96c608f897f8d5fb8b291a0.exe
PID 2208 wrote to memory of 2744	2208	a51be555c96c608f897f8d5fb8b291a0.exe	a51be555c96c608f897f8d5fb8b291a0.exe
PID 2208 wrote to memory of 2744	2208	a51be555c96c608f897f8d5fb8b291a0.exe	a51be555c96c608f897f8d5fb8b291a0.exe
PID 2208 wrote to memory of 2744	2208	a51be555c96c608f897f8d5fb8b291a0.exe	a51be555c96c608f897f8d5fb8b291a0.exe

C:\Users\Admin\AppData\Local\Temp\a51be555c96c608f897f8d5fb8b291a0.exe
"C:\Users\Admin\AppData\Local\Temp\a51be555c96c608f897f8d5fb8b291a0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2208

C:\Users\Admin\AppData\Local\Temp\a51be555c96c608f897f8d5fb8b291a0.exe
"{path}"
2⤵
PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2208-0-0x0000000074470000-0x0000000074A1B000-memory.dmp

Filesize
5.7MB

Download
memory/2208-2-0x0000000000240000-0x0000000000280000-memory.dmp

Filesize
256KB

Download
memory/2208-1-0x0000000074470000-0x0000000074A1B000-memory.dmp

Filesize
5.7MB

Download
memory/2208-3-0x0000000074470000-0x0000000074A1B000-memory.dmp

Filesize
5.7MB

Download
memory/2208-4-0x0000000000240000-0x0000000000280000-memory.dmp

Filesize
256KB

Download
memory/2208-5-0x0000000000240000-0x0000000000280000-memory.dmp

Filesize
256KB

Download
memory/2208-18-0x0000000074470000-0x0000000074A1B000-memory.dmp

Filesize
5.7MB

Download
memory/2744-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2744-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2744-12-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2744-13-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2744-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2744-16-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2744-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2744-19-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2744-20-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2744-21-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download