azorult | b09035766d93ad0b6e6c4565c7ef9eafc3d8506c29f6a0c3b9103aa2e8527463

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 18:46

Target

c69be34ab41565847dfaa5fe2fe10aea.exe
Size

850KB
MD5

c69be34ab41565847dfaa5fe2fe10aea
SHA1

f0d0b194dbd7997abd36e7de023c5b4b50043dbb
SHA256

b09035766d93ad0b6e6c4565c7ef9eafc3d8506c29f6a0c3b9103aa2e8527463
SHA512

6f2624ce0691fe71e65935d003eeb836144a7ed0fa13b6d268b2e3a324db0ade0b1a98517072f0c092955cdbceda07fb0fd7d6c8bd92db01e02213bd1aa3a5c5
SSDEEP

12288:Z1Wl8TpYMxskWv6Df4TnTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTPTTTTE:ZAGF0ykTmqtkein5Dm5g

Score

10^/10

Family

azorult

http://spreadgoodfiles.xyz/XcvU/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2804 set thread context of 2940	2804	c69be34ab41565847dfaa5fe2fe10aea.exe	28

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2804	c69be34ab41565847dfaa5fe2fe10aea.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 2940	2804	c69be34ab41565847dfaa5fe2fe10aea.exe	28
PID 2804 wrote to memory of 2940	2804	c69be34ab41565847dfaa5fe2fe10aea.exe	28
PID 2804 wrote to memory of 2940	2804	c69be34ab41565847dfaa5fe2fe10aea.exe	28
PID 2804 wrote to memory of 2940	2804	c69be34ab41565847dfaa5fe2fe10aea.exe	28
PID 2804 wrote to memory of 2940	2804	c69be34ab41565847dfaa5fe2fe10aea.exe	28

C:\Users\Admin\AppData\Local\Temp\c69be34ab41565847dfaa5fe2fe10aea.exe
"C:\Users\Admin\AppData\Local\Temp\c69be34ab41565847dfaa5fe2fe10aea.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Users\Admin\AppData\Local\Temp\c69be34ab41565847dfaa5fe2fe10aea.exe
  "C:\Users\Admin\AppData\Local\Temp\c69be34ab41565847dfaa5fe2fe10aea.exe"
  2⤵
  PID:2940

memory/2804-0-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2804-4-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2804-2-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/2804-8-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/2940-1-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2940-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2940-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2940-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download