azorult | cff2f4cae0440ebd4c4e57589210b0198dc604006e0fb70c127add914c5be655

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-03-2024 09:36

Target

ddb1b11c0fe88c29507f637ce5d5ad0c.exe
Size

275KB
MD5

ddb1b11c0fe88c29507f637ce5d5ad0c
SHA1

d635393d6ab24c920b5a08268c9884a9dfb5c970
SHA256

cff2f4cae0440ebd4c4e57589210b0198dc604006e0fb70c127add914c5be655
SHA512

964bad8601c632ab0b097d28de51934510624987f1e6a4c2c17bb9312667fe0cef3a051bedd28319dfffcfd18ba457d3b2e6a33a627c9088c4853da3b7ac23c3
SSDEEP

6144:B7AEzX1MCI7ThkXJ191agec4dSH+EnKeR2Xu:BjMD7TiXraMmSH+bXu

Score

10^/10

Family

azorult

http://203.159.80.182/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

ddb1b11c0fe88c29507f637ce5d5ad0c.exe

description pid process target process

PID 1540 set thread context of 2388 1540 ddb1b11c0fe88c29507f637ce5d5ad0c.exe ddb1b11c0fe88c29507f637ce5d5ad0c.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ddb1b11c0fe88c29507f637ce5d5ad0c.exe

pid process

1540 ddb1b11c0fe88c29507f637ce5d5ad0c.exe

description	pid	process	target process
PID 1540 set thread context of 2388	1540	ddb1b11c0fe88c29507f637ce5d5ad0c.exe	ddb1b11c0fe88c29507f637ce5d5ad0c.exe

pid	process
1540	ddb1b11c0fe88c29507f637ce5d5ad0c.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

ddb1b11c0fe88c29507f637ce5d5ad0c.exe

description	pid	process	target process
PID 1540 wrote to memory of 2388	1540	ddb1b11c0fe88c29507f637ce5d5ad0c.exe	ddb1b11c0fe88c29507f637ce5d5ad0c.exe
PID 1540 wrote to memory of 2388	1540	ddb1b11c0fe88c29507f637ce5d5ad0c.exe	ddb1b11c0fe88c29507f637ce5d5ad0c.exe
PID 1540 wrote to memory of 2388	1540	ddb1b11c0fe88c29507f637ce5d5ad0c.exe	ddb1b11c0fe88c29507f637ce5d5ad0c.exe
PID 1540 wrote to memory of 2388	1540	ddb1b11c0fe88c29507f637ce5d5ad0c.exe	ddb1b11c0fe88c29507f637ce5d5ad0c.exe
PID 1540 wrote to memory of 2388	1540	ddb1b11c0fe88c29507f637ce5d5ad0c.exe	ddb1b11c0fe88c29507f637ce5d5ad0c.exe

C:\Users\Admin\AppData\Local\Temp\ddb1b11c0fe88c29507f637ce5d5ad0c.exe
"C:\Users\Admin\AppData\Local\Temp\ddb1b11c0fe88c29507f637ce5d5ad0c.exe"
2⤵
PID:2388

memory/1540-1-0x0000000000110000-0x0000000000210000-memory.dmp

Filesize
1024KB

Download
memory/1540-2-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download
memory/2388-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2388-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2388-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2388-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2388-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download