azorult | ee298eb059f33be6909e14b0d61ba3d4c8b4c76bcf987c26896d8542fb0a5a6b

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17-03-2024 07:23

Target

d0457978ba4ccb7acc9de302ac977aec.exe
Size

422KB
MD5

d0457978ba4ccb7acc9de302ac977aec
SHA1

808f09f895d5bf0ec68f7729640e29cfe9b5132e
SHA256

ee298eb059f33be6909e14b0d61ba3d4c8b4c76bcf987c26896d8542fb0a5a6b
SHA512

8e0c69ee07dce1131bca7342fa77d44e3f32e0988d8856ffad1ac3720197fde716b38a188e7bfbed985233d45e4c61a07486d16a7ea4caab6198165981fc0aef
SSDEEP

6144:QgAnWH04t5VRDmjYSYCpNQ0OGk5//i5fxg4Y+kX:FAWHHpGY900/q5phYZX

Score

10^/10

Family

azorult

http://kylestephensphd.com/eXtYu/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

d0457978ba4ccb7acc9de302ac977aec.exe

description pid process target process

PID 2064 set thread context of 3448 2064 d0457978ba4ccb7acc9de302ac977aec.exe d0457978ba4ccb7acc9de302ac977aec.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3644 2064 WerFault.exe d0457978ba4ccb7acc9de302ac977aec.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

d0457978ba4ccb7acc9de302ac977aec.exe

pid process

2064 d0457978ba4ccb7acc9de302ac977aec.exe

description	pid	process	target process
PID 2064 set thread context of 3448	2064	d0457978ba4ccb7acc9de302ac977aec.exe	d0457978ba4ccb7acc9de302ac977aec.exe

pid	pid_target	process	target process
3644	2064	WerFault.exe	d0457978ba4ccb7acc9de302ac977aec.exe

pid	process
2064	d0457978ba4ccb7acc9de302ac977aec.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d0457978ba4ccb7acc9de302ac977aec.exe

description	pid	process	target process
PID 2064 wrote to memory of 3448	2064	d0457978ba4ccb7acc9de302ac977aec.exe	d0457978ba4ccb7acc9de302ac977aec.exe
PID 2064 wrote to memory of 3448	2064	d0457978ba4ccb7acc9de302ac977aec.exe	d0457978ba4ccb7acc9de302ac977aec.exe
PID 2064 wrote to memory of 3448	2064	d0457978ba4ccb7acc9de302ac977aec.exe	d0457978ba4ccb7acc9de302ac977aec.exe
PID 2064 wrote to memory of 3448	2064	d0457978ba4ccb7acc9de302ac977aec.exe	d0457978ba4ccb7acc9de302ac977aec.exe

C:\Users\Admin\AppData\Local\Temp\d0457978ba4ccb7acc9de302ac977aec.exe
"C:\Users\Admin\AppData\Local\Temp\d0457978ba4ccb7acc9de302ac977aec.exe"
2⤵
PID:3448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 324
2⤵
- Program crash
PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2064 -ip 2064
1⤵
PID:3484

memory/2064-0-0x0000000000820000-0x0000000000859000-memory.dmp

Filesize
228KB

Download
memory/2064-1-0x0000000001220000-0x0000000001222000-memory.dmp

Filesize
8KB

Download
memory/3448-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3448-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3448-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3448-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download