azorult | d803bbeca71dfcbc03c2e8fed4dbb5c7ccdd778c70558ca282df97dea20fc1bf

General

Target

51034ad4a20dec916ce9a900a667be57.exe
Size

420KB
MD5

51034ad4a20dec916ce9a900a667be57
SHA1

74503a74d7a2b82a4390b092e6c4b66656c6f2ea
SHA256

d803bbeca71dfcbc03c2e8fed4dbb5c7ccdd778c70558ca282df97dea20fc1bf
SHA512

89c17f7189fd25055e2fa48f0296f453ff3317d5baf799732c4d7a6f307dc77db2e8004459766ac78dafa312d3f8a6c0b9df8e32aa8a2df6e71314a9388f4e61
SSDEEP

6144:KSTz3MaMNhXbyuWt2EHOO+7qeA5fphPFrKz1K59uYtuwI9JXhr5464NYCmkG0PRy:3Ty7A9ugI9fFCmAPRdhe

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://xcelonline.000webhostapp.com/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3068 set thread context of 1936	3068	51034ad4a20dec916ce9a900a667be57.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2548	1936	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3068	51034ad4a20dec916ce9a900a667be57.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3068	51034ad4a20dec916ce9a900a667be57.exe
3068	51034ad4a20dec916ce9a900a667be57.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 1936	3068	51034ad4a20dec916ce9a900a667be57.exe	28
PID 3068 wrote to memory of 1936	3068	51034ad4a20dec916ce9a900a667be57.exe	28
PID 3068 wrote to memory of 1936	3068	51034ad4a20dec916ce9a900a667be57.exe	28
PID 3068 wrote to memory of 1936	3068	51034ad4a20dec916ce9a900a667be57.exe	28
PID 3068 wrote to memory of 1936	3068	51034ad4a20dec916ce9a900a667be57.exe	28
PID 3068 wrote to memory of 1936	3068	51034ad4a20dec916ce9a900a667be57.exe	28
PID 3068 wrote to memory of 1936	3068	51034ad4a20dec916ce9a900a667be57.exe	28
PID 3068 wrote to memory of 1936	3068	51034ad4a20dec916ce9a900a667be57.exe	28
PID 3068 wrote to memory of 1936	3068	51034ad4a20dec916ce9a900a667be57.exe	28
PID 3068 wrote to memory of 1936	3068	51034ad4a20dec916ce9a900a667be57.exe	28
PID 3068 wrote to memory of 1936	3068	51034ad4a20dec916ce9a900a667be57.exe	28
PID 3068 wrote to memory of 1936	3068	51034ad4a20dec916ce9a900a667be57.exe	28
PID 3068 wrote to memory of 1936	3068	51034ad4a20dec916ce9a900a667be57.exe	28
PID 3068 wrote to memory of 1936	3068	51034ad4a20dec916ce9a900a667be57.exe	28
PID 3068 wrote to memory of 1936	3068	51034ad4a20dec916ce9a900a667be57.exe	28
PID 3068 wrote to memory of 1936	3068	51034ad4a20dec916ce9a900a667be57.exe	28
PID 3068 wrote to memory of 1936	3068	51034ad4a20dec916ce9a900a667be57.exe	28
PID 1936 wrote to memory of 2548	1936	51034ad4a20dec916ce9a900a667be57.exe	29
PID 1936 wrote to memory of 2548	1936	51034ad4a20dec916ce9a900a667be57.exe	29
PID 1936 wrote to memory of 2548	1936	51034ad4a20dec916ce9a900a667be57.exe	29
PID 1936 wrote to memory of 2548	1936	51034ad4a20dec916ce9a900a667be57.exe	29

C:\Users\Admin\AppData\Local\Temp\51034ad4a20dec916ce9a900a667be57.exe
"C:\Users\Admin\AppData\Local\Temp\51034ad4a20dec916ce9a900a667be57.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\51034ad4a20dec916ce9a900a667be57.exe
  C:\Users\Admin\AppData\Local\Temp\51034ad4a20dec916ce9a900a667be57.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 744
    3⤵
    - Program crash
    PID:2548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1936-0-0x0000000000300000-0x0000000000400000-memory.dmp

Filesize
1024KB

Download
memory/1936-1-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/1936-3-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/1936-5-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/1936-7-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/1936-9-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/1936-11-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/1936-13-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/1936-15-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/1936-17-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/1936-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1936-21-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/1936-24-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/1936-26-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/1936-27-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/1936-28-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download
memory/1936-29-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1936-31-0x0000000000400000-0x0000000001080000-memory.dmp

Filesize
12.5MB

Download

Analysis

Sharing