azorult | ee298eb059f33be6909e14b0d61ba3d4c8b4c76bcf987c26896d8542fb0a5a6b

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-03-2024 07:23

Target

d0457978ba4ccb7acc9de302ac977aec.exe
Size

422KB
MD5

d0457978ba4ccb7acc9de302ac977aec
SHA1

808f09f895d5bf0ec68f7729640e29cfe9b5132e
SHA256

ee298eb059f33be6909e14b0d61ba3d4c8b4c76bcf987c26896d8542fb0a5a6b
SHA512

8e0c69ee07dce1131bca7342fa77d44e3f32e0988d8856ffad1ac3720197fde716b38a188e7bfbed985233d45e4c61a07486d16a7ea4caab6198165981fc0aef
SSDEEP

6144:QgAnWH04t5VRDmjYSYCpNQ0OGk5//i5fxg4Y+kX:FAWHHpGY900/q5phYZX

Score

10^/10

Family

azorult

http://kylestephensphd.com/eXtYu/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

d0457978ba4ccb7acc9de302ac977aec.exe

description pid process target process

PID 2248 set thread context of 2368 2248 d0457978ba4ccb7acc9de302ac977aec.exe d0457978ba4ccb7acc9de302ac977aec.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

d0457978ba4ccb7acc9de302ac977aec.exe

pid process

2248 d0457978ba4ccb7acc9de302ac977aec.exe

description	pid	process	target process
PID 2248 set thread context of 2368	2248	d0457978ba4ccb7acc9de302ac977aec.exe	d0457978ba4ccb7acc9de302ac977aec.exe

pid	process
2248	d0457978ba4ccb7acc9de302ac977aec.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

d0457978ba4ccb7acc9de302ac977aec.exe

description	pid	process	target process
PID 2248 wrote to memory of 2368	2248	d0457978ba4ccb7acc9de302ac977aec.exe	d0457978ba4ccb7acc9de302ac977aec.exe
PID 2248 wrote to memory of 2368	2248	d0457978ba4ccb7acc9de302ac977aec.exe	d0457978ba4ccb7acc9de302ac977aec.exe
PID 2248 wrote to memory of 2368	2248	d0457978ba4ccb7acc9de302ac977aec.exe	d0457978ba4ccb7acc9de302ac977aec.exe
PID 2248 wrote to memory of 2368	2248	d0457978ba4ccb7acc9de302ac977aec.exe	d0457978ba4ccb7acc9de302ac977aec.exe
PID 2248 wrote to memory of 2368	2248	d0457978ba4ccb7acc9de302ac977aec.exe	d0457978ba4ccb7acc9de302ac977aec.exe

C:\Users\Admin\AppData\Local\Temp\d0457978ba4ccb7acc9de302ac977aec.exe
"C:\Users\Admin\AppData\Local\Temp\d0457978ba4ccb7acc9de302ac977aec.exe"
2⤵
PID:2368

memory/2248-0-0x0000000000B70000-0x0000000000BA9000-memory.dmp

Filesize
228KB

Download
memory/2248-1-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/2368-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2368-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2368-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2368-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download