azorult | 8af29fa0538435829ca772454afc22c73d41dbb6d8174ea270f027a9a3e651a9 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 23:24

Sharing

Report Analysis Logs

General

Target

Bank information.exe
Size

488KB
MD5

a386cb74cccaecda00ec2780600ddbf2
SHA1

e86f2bbb1a5b54fda1387dc65152db098e755fe3
SHA256

c1efb0125cda0bb2e6dea422fdec99a5c0dda5814f57f9cd214162cb7bf985b3
SHA512

3188c0b66f12a11e65077d2acccaf899b87cfb8e7f224e1047c54831ea1a6686cc99b0a0f47a10335d18dd4c87944bdf98ab215086ab516063a863ad4faf63b6
SSDEEP

12288:JtPts6SKmo3W4aIIrVeGloNydn2eccfsrh:3tuLo3WS/GCCNcv

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://jahblessus.gq/obinna/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 328 set thread context of 1932	328	Bank information.exe	28
PID 328 set thread context of 1932	328	Bank information.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
328	Bank information.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 328 wrote to memory of 1932	328	Bank information.exe	28
PID 328 wrote to memory of 1932	328	Bank information.exe	28
PID 328 wrote to memory of 1932	328	Bank information.exe	28
PID 328 wrote to memory of 1932	328	Bank information.exe	28
PID 328 wrote to memory of 1932	328	Bank information.exe	28
PID 328 wrote to memory of 1932	328	Bank information.exe	28
PID 328 wrote to memory of 1932	328	Bank information.exe	28
PID 328 wrote to memory of 1932	328	Bank information.exe	28
PID 328 wrote to memory of 1932	328	Bank information.exe	28
PID 328 wrote to memory of 1932	328	Bank information.exe	28
PID 328 wrote to memory of 1932	328	Bank information.exe	28
PID 328 wrote to memory of 1932	328	Bank information.exe	28

C:\Users\Admin\AppData\Local\Temp\Bank information.exe
"C:\Users\Admin\AppData\Local\Temp\Bank information.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:328
- C:\Users\Admin\AppData\Local\Temp\Bank information.exe
  "C:\Users\Admin\AppData\Local\Temp\Bank information.exe"
  2⤵
  PID:1932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1932-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1932-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download