azorult | a197c0c04b61fcd2824b032b3e4f019d00228b3e6f79100058f14c2b777e5754

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 12:57

Target

51b655d0853dfede83ea8fc3eb2c63b5fefc4bd852d50591a5a78cb8bc9ce9d7.exe
Size

960KB
MD5

90559c1f9ac3d674ef0f89530f40e561
SHA1

dfc760de338a70ed58250c08976eb79e64612e8d
SHA256

51b655d0853dfede83ea8fc3eb2c63b5fefc4bd852d50591a5a78cb8bc9ce9d7
SHA512

71bf39fc2b4cc294cd5d149ce8c2ea3776478568915ad42f2d6c0ddca581bc89d470de728a831c974799f2f06a2fadfa959c13c9a1379d2cb7aa024492af9a4f
SSDEEP

24576:Atb20pkaCqT5TBWgNQ7aNdVxxg5lHZlLcmg6A:JVg5tQ7aNdVxyDLw5

Score

10^/10

Family

azorult

http://mhlc.shop/MC341/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

51b655d0853dfede83ea8fc3eb2c63b5fefc4bd852d50591a5a78cb8bc9ce9d7.exe

description	pid	process	target process
PID 2856 set thread context of 8	2856	51b655d0853dfede83ea8fc3eb2c63b5fefc4bd852d50591a5a78cb8bc9ce9d7.exe	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

51b655d0853dfede83ea8fc3eb2c63b5fefc4bd852d50591a5a78cb8bc9ce9d7.exe

pid process

2856 51b655d0853dfede83ea8fc3eb2c63b5fefc4bd852d50591a5a78cb8bc9ce9d7.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

51b655d0853dfede83ea8fc3eb2c63b5fefc4bd852d50591a5a78cb8bc9ce9d7.exe

pid	process
2856	51b655d0853dfede83ea8fc3eb2c63b5fefc4bd852d50591a5a78cb8bc9ce9d7.exe
2856	51b655d0853dfede83ea8fc3eb2c63b5fefc4bd852d50591a5a78cb8bc9ce9d7.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

51b655d0853dfede83ea8fc3eb2c63b5fefc4bd852d50591a5a78cb8bc9ce9d7.exe

pid	process
2856	51b655d0853dfede83ea8fc3eb2c63b5fefc4bd852d50591a5a78cb8bc9ce9d7.exe
2856	51b655d0853dfede83ea8fc3eb2c63b5fefc4bd852d50591a5a78cb8bc9ce9d7.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

51b655d0853dfede83ea8fc3eb2c63b5fefc4bd852d50591a5a78cb8bc9ce9d7.exe

description	pid	process	target process
PID 2856 wrote to memory of 8	2856	51b655d0853dfede83ea8fc3eb2c63b5fefc4bd852d50591a5a78cb8bc9ce9d7.exe	svchost.exe
PID 2856 wrote to memory of 8	2856	51b655d0853dfede83ea8fc3eb2c63b5fefc4bd852d50591a5a78cb8bc9ce9d7.exe	svchost.exe
PID 2856 wrote to memory of 8	2856	51b655d0853dfede83ea8fc3eb2c63b5fefc4bd852d50591a5a78cb8bc9ce9d7.exe	svchost.exe
PID 2856 wrote to memory of 8	2856	51b655d0853dfede83ea8fc3eb2c63b5fefc4bd852d50591a5a78cb8bc9ce9d7.exe	svchost.exe

C:\Windows\SysWOW64\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\51b655d0853dfede83ea8fc3eb2c63b5fefc4bd852d50591a5a78cb8bc9ce9d7.exe"
2⤵
PID:8

memory/8-11-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/8-13-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/8-14-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/8-15-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2856-10-0x0000000000F40000-0x0000000000F44000-memory.dmp

Filesize
16KB

Download