azorult | cff2f4cae0440ebd4c4e57589210b0198dc604006e0fb70c127add914c5be655

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2024 09:36

Target

ddb1b11c0fe88c29507f637ce5d5ad0c.exe
Size

275KB
MD5

ddb1b11c0fe88c29507f637ce5d5ad0c
SHA1

d635393d6ab24c920b5a08268c9884a9dfb5c970
SHA256

cff2f4cae0440ebd4c4e57589210b0198dc604006e0fb70c127add914c5be655
SHA512

964bad8601c632ab0b097d28de51934510624987f1e6a4c2c17bb9312667fe0cef3a051bedd28319dfffcfd18ba457d3b2e6a33a627c9088c4853da3b7ac23c3
SSDEEP

6144:B7AEzX1MCI7ThkXJ191agec4dSH+EnKeR2Xu:BjMD7TiXraMmSH+bXu

Score

10^/10

Family

azorult

http://203.159.80.182/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

ddb1b11c0fe88c29507f637ce5d5ad0c.exe

description pid process target process

PID 3496 set thread context of 4308 3496 ddb1b11c0fe88c29507f637ce5d5ad0c.exe ddb1b11c0fe88c29507f637ce5d5ad0c.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3060 3496 WerFault.exe ddb1b11c0fe88c29507f637ce5d5ad0c.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ddb1b11c0fe88c29507f637ce5d5ad0c.exe

pid process

3496 ddb1b11c0fe88c29507f637ce5d5ad0c.exe

description	pid	process	target process
PID 3496 set thread context of 4308	3496	ddb1b11c0fe88c29507f637ce5d5ad0c.exe	ddb1b11c0fe88c29507f637ce5d5ad0c.exe

pid	pid_target	process	target process
3060	3496	WerFault.exe	ddb1b11c0fe88c29507f637ce5d5ad0c.exe

pid	process
3496	ddb1b11c0fe88c29507f637ce5d5ad0c.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ddb1b11c0fe88c29507f637ce5d5ad0c.exe

description	pid	process	target process
PID 3496 wrote to memory of 4308	3496	ddb1b11c0fe88c29507f637ce5d5ad0c.exe	ddb1b11c0fe88c29507f637ce5d5ad0c.exe
PID 3496 wrote to memory of 4308	3496	ddb1b11c0fe88c29507f637ce5d5ad0c.exe	ddb1b11c0fe88c29507f637ce5d5ad0c.exe
PID 3496 wrote to memory of 4308	3496	ddb1b11c0fe88c29507f637ce5d5ad0c.exe	ddb1b11c0fe88c29507f637ce5d5ad0c.exe
PID 3496 wrote to memory of 4308	3496	ddb1b11c0fe88c29507f637ce5d5ad0c.exe	ddb1b11c0fe88c29507f637ce5d5ad0c.exe

C:\Users\Admin\AppData\Local\Temp\ddb1b11c0fe88c29507f637ce5d5ad0c.exe
"C:\Users\Admin\AppData\Local\Temp\ddb1b11c0fe88c29507f637ce5d5ad0c.exe"
2⤵
PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 320
2⤵
- Program crash
PID:3060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3496 -ip 3496
1⤵
PID:4028

memory/3496-2-0x00000000006B0000-0x00000000006B2000-memory.dmp

Filesize
8KB

Download
memory/3496-1-0x0000000000110000-0x0000000000210000-memory.dmp

Filesize
1024KB

Download
memory/4308-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4308-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4308-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4308-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4308-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download