azorult | 8af29fa0538435829ca772454afc22c73d41dbb6d8174ea270f027a9a3e651a9 | Triage

Analysis

max time kernel
136s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2024 23:24

Sharing

Report Analysis Logs

General

Target

Bank information.exe
Size

488KB
MD5

a386cb74cccaecda00ec2780600ddbf2
SHA1

e86f2bbb1a5b54fda1387dc65152db098e755fe3
SHA256

c1efb0125cda0bb2e6dea422fdec99a5c0dda5814f57f9cd214162cb7bf985b3
SHA512

3188c0b66f12a11e65077d2acccaf899b87cfb8e7f224e1047c54831ea1a6686cc99b0a0f47a10335d18dd4c87944bdf98ab215086ab516063a863ad4faf63b6
SSDEEP

12288:JtPts6SKmo3W4aIIrVeGloNydn2eccfsrh:3tuLo3WS/GCCNcv

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://jahblessus.gq/obinna/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4840 set thread context of 3764	4840	Bank information.exe	82

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4840	Bank information.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 3764	4840	Bank information.exe	82
PID 4840 wrote to memory of 3764	4840	Bank information.exe	82
PID 4840 wrote to memory of 3764	4840	Bank information.exe	82
PID 4840 wrote to memory of 3764	4840	Bank information.exe	82
PID 4840 wrote to memory of 3764	4840	Bank information.exe	82
PID 4840 wrote to memory of 3764	4840	Bank information.exe	82
PID 4840 wrote to memory of 3764	4840	Bank information.exe	82
PID 4840 wrote to memory of 3764	4840	Bank information.exe	82
PID 4840 wrote to memory of 3764	4840	Bank information.exe	82
PID 4840 wrote to memory of 3764	4840	Bank information.exe	82
PID 4840 wrote to memory of 3764	4840	Bank information.exe	82

C:\Users\Admin\AppData\Local\Temp\Bank information.exe
"C:\Users\Admin\AppData\Local\Temp\Bank information.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Users\Admin\AppData\Local\Temp\Bank information.exe
  "C:\Users\Admin\AppData\Local\Temp\Bank information.exe"
  2⤵
  PID:3764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3764-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3764-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3764-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download