azorult | cdae5c24bd6813de0e0c71748062db520bb43ab16a1995e9de684e2ededa9cae

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-05-2024 09:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/Moustache.dll
Size

41KB
MD5

5e68491fc9296f4067d397093f25e8f4
SHA1

0447a8247227fc3a12c7b9cd24cf5717f6ea8ec0
SHA256

47b284c8cea5f056b17bed41e272d0d61d70a169d3366a53104435bb393c1e89
SHA512

4a4d6f5c81f0f161e4d70fe221192f665084e1625ba35aa052a81c6c06c706d29c920066289b948998fecd8863d799f3d33be5f850e416d47bf6be0683215b7e
SSDEEP

768:3wmqf3FVwBf7uQpwukQRhsOaGnTEDE3vyS12wfpVDt4t:3wFTwBju3LQvNSS1rfpTw

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://sinomatics.ga/~zadmin/lk/a/az/ch/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 2188 set thread context of 2224 2188 rundll32.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

2188 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

2188 rundll32.exe

description	pid	process	target process
PID 2188 set thread context of 2224	2188	rundll32.exe	rundll32.exe

pid	process
2188	rundll32.exe

pid	process
2188	rundll32.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1152 wrote to memory of 2188	1152	rundll32.exe	rundll32.exe
PID 1152 wrote to memory of 2188	1152	rundll32.exe	rundll32.exe
PID 1152 wrote to memory of 2188	1152	rundll32.exe	rundll32.exe
PID 1152 wrote to memory of 2188	1152	rundll32.exe	rundll32.exe
PID 1152 wrote to memory of 2188	1152	rundll32.exe	rundll32.exe
PID 1152 wrote to memory of 2188	1152	rundll32.exe	rundll32.exe
PID 1152 wrote to memory of 2188	1152	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2224	2188	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\Moustache.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\Moustache.dll,#1
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2188

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe"
3⤵
PID:2224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2188-0-0x0000000075250000-0x00000000752A8000-memory.dmp

Filesize
352KB

Download
memory/2188-1-0x0000000000100000-0x0000000000102000-memory.dmp

Filesize
8KB

Download
memory/2188-2-0x0000000076190000-0x00000000761C5000-memory.dmp

Filesize
212KB

Download
memory/2188-3-0x0000000077B20000-0x0000000077CC9000-memory.dmp

Filesize
1.7MB

Download
memory/2188-16-0x0000000075250000-0x00000000752A8000-memory.dmp

Filesize
352KB

Download
memory/2224-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2224-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2224-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2224-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2224-11-0x0000000077B21000-0x0000000077C22000-memory.dmp

Filesize
1.0MB

Download
memory/2224-10-0x0000000077B20000-0x0000000077CC9000-memory.dmp

Filesize
1.7MB

Download
memory/2224-17-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download