azorult | 8f9648879a2d781dbb8390f7b5b0eea36201fbf15a02b0c5d374271dd211bbdf

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-03-2024 22:59

Target

bf2e8493970a57649cec55d38f5a542b.exe
Size

457KB
MD5

bf2e8493970a57649cec55d38f5a542b
SHA1

4b515de9d55f7201c19fe177ea7a4de4569221ae
SHA256

8f9648879a2d781dbb8390f7b5b0eea36201fbf15a02b0c5d374271dd211bbdf
SHA512

9c835b7b78adbfa6950eb5c400a924fe714a64a19fdf67d48a940f2f65d0c0e2b4394192f4d6b3e777a5e992c561082dcd2d516b0e37860a89b2e158cde18509
SSDEEP

12288:OGKE6iuzAoYSrQb5lAA7OZBq7yeIGa6cA3l:OcxuSbUVWcI

Score

10^/10

Family

azorult

http://37.0.10.179/PL341/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1308 set thread context of 2748	1308	bf2e8493970a57649cec55d38f5a542b.exe	29

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1308	bf2e8493970a57649cec55d38f5a542b.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2748	1308	bf2e8493970a57649cec55d38f5a542b.exe	29
PID 1308 wrote to memory of 2748	1308	bf2e8493970a57649cec55d38f5a542b.exe	29
PID 1308 wrote to memory of 2748	1308	bf2e8493970a57649cec55d38f5a542b.exe	29
PID 1308 wrote to memory of 2748	1308	bf2e8493970a57649cec55d38f5a542b.exe	29
PID 1308 wrote to memory of 2748	1308	bf2e8493970a57649cec55d38f5a542b.exe	29

C:\Users\Admin\AppData\Local\Temp\bf2e8493970a57649cec55d38f5a542b.exe
"C:\Users\Admin\AppData\Local\Temp\bf2e8493970a57649cec55d38f5a542b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Users\Admin\AppData\Local\Temp\bf2e8493970a57649cec55d38f5a542b.exe
  "C:\Users\Admin\AppData\Local\Temp\bf2e8493970a57649cec55d38f5a542b.exe"
  2⤵
  PID:2748

memory/1308-1-0x0000000000090000-0x0000000000190000-memory.dmp

Filesize
1024KB

Download
memory/1308-2-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/2748-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2748-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2748-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2748-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2748-11-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2748-13-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download