azorult | a3a84046f1f21bdedb4a483ccc0fc2fa82a131e459fcf6d2f87c3cac3afb4e74

Analysis

max time kernel
93s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-02-2024 02:36

Target

ad78e093751100e854f713c6f95e5dd6.exe
Size

370KB
MD5

ad78e093751100e854f713c6f95e5dd6
SHA1

779c573851259e2e905f8ab69d6481a53b3dfe0e
SHA256

a3a84046f1f21bdedb4a483ccc0fc2fa82a131e459fcf6d2f87c3cac3afb4e74
SHA512

930360f82fabfeea9ebb46fc4c1d8974f8e4c5b01faf05ce391150d5dfadfc8714dc1dba0ba6c13c6f4b3cea23ca0bc9b719d0d503e7cdf07806829bc7b8fa36
SSDEEP

6144:BhuFDlnWmQ5R2O2JAKHv1pMrUZ4JoruxOIIg3J9QUA/TBKik0Z2hQptyFf:AlqEO2qKNyrl0Qbkk0GQ

Score

10^/10

Family

azorult

http://37.0.10.99/PL341/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4192-0-0x0000000000FE0000-0x0000000001042000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Suspicious use of SetThreadContext 1 IoCs

Processes:

ad78e093751100e854f713c6f95e5dd6.exe

description pid process target process

PID 4192 set thread context of 1820 4192 ad78e093751100e854f713c6f95e5dd6.exe aspnet_compiler.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ad78e093751100e854f713c6f95e5dd6.exe

pid process

4192 ad78e093751100e854f713c6f95e5dd6.exe
4192 ad78e093751100e854f713c6f95e5dd6.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ad78e093751100e854f713c6f95e5dd6.exe

description pid process

Token: SeDebugPrivilege 4192 ad78e093751100e854f713c6f95e5dd6.exe

description	pid	process	target process
PID 4192 set thread context of 1820	4192	ad78e093751100e854f713c6f95e5dd6.exe	aspnet_compiler.exe

pid	process
4192	ad78e093751100e854f713c6f95e5dd6.exe
4192	ad78e093751100e854f713c6f95e5dd6.exe

description	pid	process
Token: SeDebugPrivilege	4192	ad78e093751100e854f713c6f95e5dd6.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

ad78e093751100e854f713c6f95e5dd6.exe

description	pid	process	target process
PID 4192 wrote to memory of 64	4192	ad78e093751100e854f713c6f95e5dd6.exe	aspnet_compiler.exe
PID 4192 wrote to memory of 64	4192	ad78e093751100e854f713c6f95e5dd6.exe	aspnet_compiler.exe
PID 4192 wrote to memory of 64	4192	ad78e093751100e854f713c6f95e5dd6.exe	aspnet_compiler.exe
PID 4192 wrote to memory of 1820	4192	ad78e093751100e854f713c6f95e5dd6.exe	aspnet_compiler.exe
PID 4192 wrote to memory of 1820	4192	ad78e093751100e854f713c6f95e5dd6.exe	aspnet_compiler.exe
PID 4192 wrote to memory of 1820	4192	ad78e093751100e854f713c6f95e5dd6.exe	aspnet_compiler.exe
PID 4192 wrote to memory of 1820	4192	ad78e093751100e854f713c6f95e5dd6.exe	aspnet_compiler.exe
PID 4192 wrote to memory of 1820	4192	ad78e093751100e854f713c6f95e5dd6.exe	aspnet_compiler.exe
PID 4192 wrote to memory of 1820	4192	ad78e093751100e854f713c6f95e5dd6.exe	aspnet_compiler.exe
PID 4192 wrote to memory of 1820	4192	ad78e093751100e854f713c6f95e5dd6.exe	aspnet_compiler.exe
PID 4192 wrote to memory of 1820	4192	ad78e093751100e854f713c6f95e5dd6.exe	aspnet_compiler.exe
PID 4192 wrote to memory of 1820	4192	ad78e093751100e854f713c6f95e5dd6.exe	aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
2⤵
PID:64

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
2⤵
PID:1820

memory/1820-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1820-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1820-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1820-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1820-11-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4192-0-0x0000000000FE0000-0x0000000001042000-memory.dmp

Filesize
392KB

Download
memory/4192-1-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/4192-2-0x00000000059F0000-0x0000000005A8C000-memory.dmp

Filesize
624KB

Download
memory/4192-3-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/4192-8-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download