azorult | 464e8d4a7003d8a0b1fa1ac3329507374f8e99d6b0fa9948ae3244b7c665e12c

Analysis

max time kernel
173s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2024 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c228fe269d0c65502364e0f52edee4f6.exe
Size

329KB
MD5

c228fe269d0c65502364e0f52edee4f6
SHA1

134c16febaceaf290624604eca5f2541af0827b6
SHA256

464e8d4a7003d8a0b1fa1ac3329507374f8e99d6b0fa9948ae3244b7c665e12c
SHA512

080b5a5930569b5ffe7873eeba16191d58a4daf3a4fdf169a2f2126f9f8fad15182138c40ef2c3a295144bfa5defd05785adcae6d9bed35de4e3e8f3cd2546ef
SSDEEP

6144:VO+W8I3UJWiC3Oq4csVJemXikfcYv56Irrs62Bnt2q0sOyE:VJW8I3UJC3OHzXbkU5d2BnC

Score

10^/10

azorult agilenet infostealer trojan

Malware Config

Extracted

Family

azorult

http://casiworksplcs.xyz/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/3496-9-0x00000000053E0000-0x00000000053EA000-memory.dmp	agile_net

Suspicious use of SetThreadContext 1 IoCs

Processes:

c228fe269d0c65502364e0f52edee4f6.exe

description pid process target process

PID 3496 set thread context of 1824 3496 c228fe269d0c65502364e0f52edee4f6.exe svchost.exe

description	pid	process	target process
PID 3496 set thread context of 1824	3496	c228fe269d0c65502364e0f52edee4f6.exe	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

c228fe269d0c65502364e0f52edee4f6.exe

description	pid	process
Token: SeDebugPrivilege	3496	c228fe269d0c65502364e0f52edee4f6.exe
Token: 33	3496	c228fe269d0c65502364e0f52edee4f6.exe
Token: SeIncBasePriorityPrivilege	3496	c228fe269d0c65502364e0f52edee4f6.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

c228fe269d0c65502364e0f52edee4f6.exe

description	pid	process	target process
PID 3496 wrote to memory of 1824	3496	c228fe269d0c65502364e0f52edee4f6.exe	svchost.exe
PID 3496 wrote to memory of 1824	3496	c228fe269d0c65502364e0f52edee4f6.exe	svchost.exe
PID 3496 wrote to memory of 1824	3496	c228fe269d0c65502364e0f52edee4f6.exe	svchost.exe
PID 3496 wrote to memory of 1824	3496	c228fe269d0c65502364e0f52edee4f6.exe	svchost.exe
PID 3496 wrote to memory of 1824	3496	c228fe269d0c65502364e0f52edee4f6.exe	svchost.exe
PID 3496 wrote to memory of 1824	3496	c228fe269d0c65502364e0f52edee4f6.exe	svchost.exe
PID 3496 wrote to memory of 1824	3496	c228fe269d0c65502364e0f52edee4f6.exe	svchost.exe
PID 3496 wrote to memory of 1824	3496	c228fe269d0c65502364e0f52edee4f6.exe	svchost.exe
PID 3496 wrote to memory of 1824	3496	c228fe269d0c65502364e0f52edee4f6.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\c228fe269d0c65502364e0f52edee4f6.exe
"C:\Users\Admin\AppData\Local\Temp\c228fe269d0c65502364e0f52edee4f6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3496

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\system32\svchost.exe"
2⤵
PID:1824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1824-12-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1824-18-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1824-17-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1824-15-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3496-4-0x00000000058A0000-0x0000000005E44000-memory.dmp

Filesize
5.6MB

Download
memory/3496-5-0x0000000005490000-0x00000000054A0000-memory.dmp

Filesize
64KB

Download
memory/3496-6-0x00000000051F0000-0x00000000051F8000-memory.dmp

Filesize
32KB

Download
memory/3496-7-0x0000000005200000-0x000000000520E000-memory.dmp

Filesize
56KB

Download
memory/3496-8-0x0000000074800000-0x0000000074FB0000-memory.dmp

Filesize
7.7MB

Download
memory/3496-9-0x00000000053E0000-0x00000000053EA000-memory.dmp

Filesize
40KB

Download
memory/3496-10-0x0000000005EF0000-0x0000000005F8C000-memory.dmp

Filesize
624KB

Download
memory/3496-11-0x0000000005490000-0x00000000054A0000-memory.dmp

Filesize
64KB

Download
memory/3496-0-0x0000000074800000-0x0000000074FB0000-memory.dmp

Filesize
7.7MB

Download
memory/3496-3-0x0000000005150000-0x0000000005180000-memory.dmp

Filesize
192KB

Download
memory/3496-2-0x0000000005250000-0x00000000052E2000-memory.dmp

Filesize
584KB

Download
memory/3496-16-0x0000000074800000-0x0000000074FB0000-memory.dmp

Filesize
7.7MB

Download
memory/3496-1-0x0000000000790000-0x00000000007E8000-memory.dmp

Filesize
352KB

Download