azorult | d803bbeca71dfcbc03c2e8fed4dbb5c7ccdd778c70558ca282df97dea20fc1bf

General

Target

51034ad4a20dec916ce9a900a667be57.exe
Size

420KB
MD5

51034ad4a20dec916ce9a900a667be57
SHA1

74503a74d7a2b82a4390b092e6c4b66656c6f2ea
SHA256

d803bbeca71dfcbc03c2e8fed4dbb5c7ccdd778c70558ca282df97dea20fc1bf
SHA512

89c17f7189fd25055e2fa48f0296f453ff3317d5baf799732c4d7a6f307dc77db2e8004459766ac78dafa312d3f8a6c0b9df8e32aa8a2df6e71314a9388f4e61
SSDEEP

6144:KSTz3MaMNhXbyuWt2EHOO+7qeA5fphPFrKz1K59uYtuwI9JXhr5464NYCmkG0PRy:3Ty7A9ugI9fFCmAPRdhe

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://xcelonline.000webhostapp.com/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

51034ad4a20dec916ce9a900a667be57.exe

description pid process target process

PID 1904 set thread context of 2208 1904 51034ad4a20dec916ce9a900a667be57.exe 51034ad4a20dec916ce9a900a667be57.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2440 2208 WerFault.exe 51034ad4a20dec916ce9a900a667be57.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

51034ad4a20dec916ce9a900a667be57.exe

pid process

1904 51034ad4a20dec916ce9a900a667be57.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

51034ad4a20dec916ce9a900a667be57.exe

pid process

1904 51034ad4a20dec916ce9a900a667be57.exe
1904 51034ad4a20dec916ce9a900a667be57.exe

description	pid	process	target process
PID 1904 set thread context of 2208	1904	51034ad4a20dec916ce9a900a667be57.exe	51034ad4a20dec916ce9a900a667be57.exe

pid	pid_target	process	target process
2440	2208	WerFault.exe	51034ad4a20dec916ce9a900a667be57.exe

pid	process
1904	51034ad4a20dec916ce9a900a667be57.exe

pid	process
1904	51034ad4a20dec916ce9a900a667be57.exe
1904	51034ad4a20dec916ce9a900a667be57.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

51034ad4a20dec916ce9a900a667be57.exe51034ad4a20dec916ce9a900a667be57.exe

C:\Users\Admin\AppData\Local\Temp\51034ad4a20dec916ce9a900a667be57.exe
"C:\Users\Admin\AppData\Local\Temp\51034ad4a20dec916ce9a900a667be57.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904

C:\Users\Admin\AppData\Local\Temp\51034ad4a20dec916ce9a900a667be57.exe
C:\Users\Admin\AppData\Local\Temp\51034ad4a20dec916ce9a900a667be57.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 748
3⤵
- Program crash
PID:2440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2208-0-0x0000000000300000-0x0000000000400000-memory.dmp

Filesize
1024KB

Download
memory/2208-1-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/2208-3-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/2208-5-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/2208-7-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/2208-9-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/2208-11-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/2208-13-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/2208-15-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/2208-17-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/2208-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2208-21-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/2208-24-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/2208-26-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/2208-27-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/2208-28-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/2208-29-0x0000000000400000-0x0000000000680000-memory.dmp

Filesize
2.5MB

Download
memory/2208-30-0x0000000000400000-0x0000000000680000-memory.dmp

Filesize
2.5MB

Download
memory/2208-32-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download

description	pid	process	target process
PID 1904 wrote to memory of 2208	1904	51034ad4a20dec916ce9a900a667be57.exe	51034ad4a20dec916ce9a900a667be57.exe
PID 1904 wrote to memory of 2208	1904	51034ad4a20dec916ce9a900a667be57.exe	51034ad4a20dec916ce9a900a667be57.exe
PID 1904 wrote to memory of 2208	1904	51034ad4a20dec916ce9a900a667be57.exe	51034ad4a20dec916ce9a900a667be57.exe
PID 1904 wrote to memory of 2208	1904	51034ad4a20dec916ce9a900a667be57.exe	51034ad4a20dec916ce9a900a667be57.exe
PID 1904 wrote to memory of 2208	1904	51034ad4a20dec916ce9a900a667be57.exe	51034ad4a20dec916ce9a900a667be57.exe
PID 1904 wrote to memory of 2208	1904	51034ad4a20dec916ce9a900a667be57.exe	51034ad4a20dec916ce9a900a667be57.exe
PID 1904 wrote to memory of 2208	1904	51034ad4a20dec916ce9a900a667be57.exe	51034ad4a20dec916ce9a900a667be57.exe
PID 1904 wrote to memory of 2208	1904	51034ad4a20dec916ce9a900a667be57.exe	51034ad4a20dec916ce9a900a667be57.exe
PID 1904 wrote to memory of 2208	1904	51034ad4a20dec916ce9a900a667be57.exe	51034ad4a20dec916ce9a900a667be57.exe
PID 1904 wrote to memory of 2208	1904	51034ad4a20dec916ce9a900a667be57.exe	51034ad4a20dec916ce9a900a667be57.exe
PID 1904 wrote to memory of 2208	1904	51034ad4a20dec916ce9a900a667be57.exe	51034ad4a20dec916ce9a900a667be57.exe
PID 1904 wrote to memory of 2208	1904	51034ad4a20dec916ce9a900a667be57.exe	51034ad4a20dec916ce9a900a667be57.exe
PID 1904 wrote to memory of 2208	1904	51034ad4a20dec916ce9a900a667be57.exe	51034ad4a20dec916ce9a900a667be57.exe
PID 1904 wrote to memory of 2208	1904	51034ad4a20dec916ce9a900a667be57.exe	51034ad4a20dec916ce9a900a667be57.exe
PID 1904 wrote to memory of 2208	1904	51034ad4a20dec916ce9a900a667be57.exe	51034ad4a20dec916ce9a900a667be57.exe
PID 1904 wrote to memory of 2208	1904	51034ad4a20dec916ce9a900a667be57.exe	51034ad4a20dec916ce9a900a667be57.exe
PID 1904 wrote to memory of 2208	1904	51034ad4a20dec916ce9a900a667be57.exe	51034ad4a20dec916ce9a900a667be57.exe
PID 2208 wrote to memory of 2440	2208	51034ad4a20dec916ce9a900a667be57.exe	WerFault.exe
PID 2208 wrote to memory of 2440	2208	51034ad4a20dec916ce9a900a667be57.exe	WerFault.exe
PID 2208 wrote to memory of 2440	2208	51034ad4a20dec916ce9a900a667be57.exe	WerFault.exe
PID 2208 wrote to memory of 2440	2208	51034ad4a20dec916ce9a900a667be57.exe	WerFault.exe

Analysis

Sharing