azorult | d76f2f5bd46716639a5e0cb629bb99ff572d554896ca1abc198ba9deb1bdd116

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
20-03-2024 02:31

Target

d7a8d38fe5070399f64dd2e2a1bbf584.exe
Size

225KB
MD5

d7a8d38fe5070399f64dd2e2a1bbf584
SHA1

7f7597e2e71088f3aaa80019fb44f440180a8d1a
SHA256

d76f2f5bd46716639a5e0cb629bb99ff572d554896ca1abc198ba9deb1bdd116
SHA512

681ca2e09babe428301ac0d99d762cce9a5281d97b87e30350e1f5802ec89246eb63287b8be812d2e4d3dd4c5db50f294ea21533ac507ab5babe8f6330e8ee04
SSDEEP

6144:qmlmOTa6Qw3eQWpk9GS0fr92wCxShmVuYYSX2VZ8Casx:vkOTQdkifr9qQyJjXXsx

Score

10^/10

Family

azorult

http://212.192.246.176/PL341/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

d7a8d38fe5070399f64dd2e2a1bbf584.exe

description pid process target process

PID 548 set thread context of 5036 548 d7a8d38fe5070399f64dd2e2a1bbf584.exe MSBuild.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

d7a8d38fe5070399f64dd2e2a1bbf584.exe

pid process

548 d7a8d38fe5070399f64dd2e2a1bbf584.exe

description	pid	process	target process
PID 548 set thread context of 5036	548	d7a8d38fe5070399f64dd2e2a1bbf584.exe	MSBuild.exe

pid	process
548	d7a8d38fe5070399f64dd2e2a1bbf584.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d7a8d38fe5070399f64dd2e2a1bbf584.exe

description	pid	process	target process
PID 548 wrote to memory of 5036	548	d7a8d38fe5070399f64dd2e2a1bbf584.exe	MSBuild.exe
PID 548 wrote to memory of 5036	548	d7a8d38fe5070399f64dd2e2a1bbf584.exe	MSBuild.exe
PID 548 wrote to memory of 5036	548	d7a8d38fe5070399f64dd2e2a1bbf584.exe	MSBuild.exe
PID 548 wrote to memory of 5036	548	d7a8d38fe5070399f64dd2e2a1bbf584.exe	MSBuild.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Users\Admin\AppData\Local\Temp\d7a8d38fe5070399f64dd2e2a1bbf584.exe"
2⤵
PID:5036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4116 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:8
1⤵
PID:4972

memory/548-0-0x0000000000960000-0x0000000000966000-memory.dmp

Filesize
24KB

Download
memory/548-1-0x00000000014A0000-0x00000000014A2000-memory.dmp

Filesize
8KB

Download
memory/5036-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5036-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5036-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5036-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5036-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download