azorult | b09035766d93ad0b6e6c4565c7ef9eafc3d8506c29f6a0c3b9103aa2e8527463

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 18:46

Target

c69be34ab41565847dfaa5fe2fe10aea.exe
Size

850KB
MD5

c69be34ab41565847dfaa5fe2fe10aea
SHA1

f0d0b194dbd7997abd36e7de023c5b4b50043dbb
SHA256

b09035766d93ad0b6e6c4565c7ef9eafc3d8506c29f6a0c3b9103aa2e8527463
SHA512

6f2624ce0691fe71e65935d003eeb836144a7ed0fa13b6d268b2e3a324db0ade0b1a98517072f0c092955cdbceda07fb0fd7d6c8bd92db01e02213bd1aa3a5c5
SSDEEP

12288:Z1Wl8TpYMxskWv6Df4TnTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTPTTTTE:ZAGF0ykTmqtkein5Dm5g

Score

10^/10

Family

azorult

http://spreadgoodfiles.xyz/XcvU/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

c69be34ab41565847dfaa5fe2fe10aea.exe

description pid process target process

PID 3180 set thread context of 2936 3180 c69be34ab41565847dfaa5fe2fe10aea.exe c69be34ab41565847dfaa5fe2fe10aea.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

c69be34ab41565847dfaa5fe2fe10aea.exe

pid process

3180 c69be34ab41565847dfaa5fe2fe10aea.exe

description	pid	process	target process
PID 3180 set thread context of 2936	3180	c69be34ab41565847dfaa5fe2fe10aea.exe	c69be34ab41565847dfaa5fe2fe10aea.exe

pid	process
3180	c69be34ab41565847dfaa5fe2fe10aea.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c69be34ab41565847dfaa5fe2fe10aea.exe

description	pid	process	target process
PID 3180 wrote to memory of 2936	3180	c69be34ab41565847dfaa5fe2fe10aea.exe	c69be34ab41565847dfaa5fe2fe10aea.exe
PID 3180 wrote to memory of 2936	3180	c69be34ab41565847dfaa5fe2fe10aea.exe	c69be34ab41565847dfaa5fe2fe10aea.exe
PID 3180 wrote to memory of 2936	3180	c69be34ab41565847dfaa5fe2fe10aea.exe	c69be34ab41565847dfaa5fe2fe10aea.exe
PID 3180 wrote to memory of 2936	3180	c69be34ab41565847dfaa5fe2fe10aea.exe	c69be34ab41565847dfaa5fe2fe10aea.exe

C:\Users\Admin\AppData\Local\Temp\c69be34ab41565847dfaa5fe2fe10aea.exe
"C:\Users\Admin\AppData\Local\Temp\c69be34ab41565847dfaa5fe2fe10aea.exe"
2⤵
PID:2936

memory/2936-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2936-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2936-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2936-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3180-0-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/3180-1-0x0000000000680000-0x0000000000682000-memory.dmp

Filesize
8KB

Download
memory/3180-4-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download