azorult | d803bbeca71dfcbc03c2e8fed4dbb5c7ccdd778c70558ca282df97dea20fc1bf

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2024 04:46

Target

51034ad4a20dec916ce9a900a667be57.exe
Size

420KB
MD5

51034ad4a20dec916ce9a900a667be57
SHA1

74503a74d7a2b82a4390b092e6c4b66656c6f2ea
SHA256

d803bbeca71dfcbc03c2e8fed4dbb5c7ccdd778c70558ca282df97dea20fc1bf
SHA512

89c17f7189fd25055e2fa48f0296f453ff3317d5baf799732c4d7a6f307dc77db2e8004459766ac78dafa312d3f8a6c0b9df8e32aa8a2df6e71314a9388f4e61
SSDEEP

6144:KSTz3MaMNhXbyuWt2EHOO+7qeA5fphPFrKz1K59uYtuwI9JXhr5464NYCmkG0PRy:3Ty7A9ugI9fFCmAPRdhe

Score

10^/10

Family

azorult

http://xcelonline.000webhostapp.com/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 844 set thread context of 2720	844	51034ad4a20dec916ce9a900a667be57.exe	90

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4120	2720	WerFault.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
844	51034ad4a20dec916ce9a900a667be57.exe
844	51034ad4a20dec916ce9a900a667be57.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
844	51034ad4a20dec916ce9a900a667be57.exe
844	51034ad4a20dec916ce9a900a667be57.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 2720	844	51034ad4a20dec916ce9a900a667be57.exe	90
PID 844 wrote to memory of 2720	844	51034ad4a20dec916ce9a900a667be57.exe	90
PID 844 wrote to memory of 2720	844	51034ad4a20dec916ce9a900a667be57.exe	90
PID 844 wrote to memory of 2720	844	51034ad4a20dec916ce9a900a667be57.exe	90
PID 844 wrote to memory of 2720	844	51034ad4a20dec916ce9a900a667be57.exe	90
PID 844 wrote to memory of 2720	844	51034ad4a20dec916ce9a900a667be57.exe	90
PID 844 wrote to memory of 2720	844	51034ad4a20dec916ce9a900a667be57.exe	90
PID 844 wrote to memory of 2720	844	51034ad4a20dec916ce9a900a667be57.exe	90
PID 844 wrote to memory of 2720	844	51034ad4a20dec916ce9a900a667be57.exe	90
PID 844 wrote to memory of 2720	844	51034ad4a20dec916ce9a900a667be57.exe	90
PID 844 wrote to memory of 2720	844	51034ad4a20dec916ce9a900a667be57.exe	90
PID 844 wrote to memory of 2720	844	51034ad4a20dec916ce9a900a667be57.exe	90
PID 844 wrote to memory of 2720	844	51034ad4a20dec916ce9a900a667be57.exe	90
PID 844 wrote to memory of 2720	844	51034ad4a20dec916ce9a900a667be57.exe	90
PID 844 wrote to memory of 2720	844	51034ad4a20dec916ce9a900a667be57.exe	90
PID 844 wrote to memory of 2720	844	51034ad4a20dec916ce9a900a667be57.exe	90
PID 844 wrote to memory of 2720	844	51034ad4a20dec916ce9a900a667be57.exe	90

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2720 -ip 2720
1⤵
PID:4972

memory/2720-0-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/2720-1-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/2720-2-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/2720-3-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/2720-4-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/2720-5-0x0000000000400000-0x0000000000680000-memory.dmp

Filesize
2.5MB

Download