azorult | 98731563833b5df1e16acbc3fc3033f5d05c4c7d35cc0eab5d2a0d5bb2fb3a3e

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
26-02-2024 01:32

Target

a51be555c96c608f897f8d5fb8b291a0.exe
Size

824KB
MD5

a51be555c96c608f897f8d5fb8b291a0
SHA1

e03dc375b737cb85b5a97210a9fb91086120462d
SHA256

98731563833b5df1e16acbc3fc3033f5d05c4c7d35cc0eab5d2a0d5bb2fb3a3e
SHA512

997b5caf294887461d304a8f1307adb952ba03848fc587fa5ac26dfa26353b052cdb70812b39e54159b63afa49055a831ab2931f05cb44a8a35a373e8cb9aef3
SSDEEP

12288:nPEp+gczyhNSvRbBQHR4qz91hI0zSaNsvz+yuWDVId21NaI+E8tyvXLdBxeQTYuL:Ppdj7os9s48gu4tEsFnoGLmlXB

Score

10^/10

Family

azorult

http://45.77.188.26/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

a51be555c96c608f897f8d5fb8b291a0.exe

description pid process target process

PID 2656 set thread context of 228 2656 a51be555c96c608f897f8d5fb8b291a0.exe a51be555c96c608f897f8d5fb8b291a0.exe

description	pid	process	target process
PID 2656 set thread context of 228	2656	a51be555c96c608f897f8d5fb8b291a0.exe	a51be555c96c608f897f8d5fb8b291a0.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a51be555c96c608f897f8d5fb8b291a0.exe

description	pid	process	target process
PID 2656 wrote to memory of 228	2656	a51be555c96c608f897f8d5fb8b291a0.exe	a51be555c96c608f897f8d5fb8b291a0.exe
PID 2656 wrote to memory of 228	2656	a51be555c96c608f897f8d5fb8b291a0.exe	a51be555c96c608f897f8d5fb8b291a0.exe
PID 2656 wrote to memory of 228	2656	a51be555c96c608f897f8d5fb8b291a0.exe	a51be555c96c608f897f8d5fb8b291a0.exe
PID 2656 wrote to memory of 228	2656	a51be555c96c608f897f8d5fb8b291a0.exe	a51be555c96c608f897f8d5fb8b291a0.exe
PID 2656 wrote to memory of 228	2656	a51be555c96c608f897f8d5fb8b291a0.exe	a51be555c96c608f897f8d5fb8b291a0.exe
PID 2656 wrote to memory of 228	2656	a51be555c96c608f897f8d5fb8b291a0.exe	a51be555c96c608f897f8d5fb8b291a0.exe
PID 2656 wrote to memory of 228	2656	a51be555c96c608f897f8d5fb8b291a0.exe	a51be555c96c608f897f8d5fb8b291a0.exe
PID 2656 wrote to memory of 228	2656	a51be555c96c608f897f8d5fb8b291a0.exe	a51be555c96c608f897f8d5fb8b291a0.exe
PID 2656 wrote to memory of 228	2656	a51be555c96c608f897f8d5fb8b291a0.exe	a51be555c96c608f897f8d5fb8b291a0.exe

C:\Users\Admin\AppData\Local\Temp\a51be555c96c608f897f8d5fb8b291a0.exe
"{path}"
2⤵
PID:228

memory/228-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/228-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/228-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/228-11-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2656-0-0x0000000075180000-0x0000000075731000-memory.dmp

Filesize
5.7MB

Download
memory/2656-1-0x0000000075180000-0x0000000075731000-memory.dmp

Filesize
5.7MB

Download
memory/2656-2-0x0000000001880000-0x0000000001890000-memory.dmp

Filesize
64KB

Download
memory/2656-3-0x0000000075180000-0x0000000075731000-memory.dmp

Filesize
5.7MB

Download
memory/2656-4-0x0000000001880000-0x0000000001890000-memory.dmp

Filesize
64KB

Download
memory/2656-10-0x0000000075180000-0x0000000075731000-memory.dmp

Filesize
5.7MB

Download