azorult | 09cfbae308d3cbdf17c9c71920feee15faac8ae3c78cf70d88fffbe49e166f4e

General

Target
3effb892745cd228114d9e02a097d638.exe
Size 466KB
Sample201222-3jdtm3wmv2
SHA256 09cfbae308d3cbdf17c9c71920feee15faac8ae3c78cf70d88fffbe49e166f4e
MD5 3effb892745cd228114d9e02a097d638
SHA1 d737a3caf59443f1302db5349e28bfd9a20475c8
SHA512 5378195916be35ca975fec3d068f462a41561e419008a57df3f45ed25de2a529fa702e95d4341d7def7e2ad09fc437d3584149718d60d074d1bab33f49f91588
MD5 SHA1 SHA512

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Executes dropped EXE 1 IoCs

pid	Process
2624	AddInProcess32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 500 set thread context of 2624	500	3effb892745cd228114d9e02a097d638.exe	78

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2120	2624	WerFault.exe	78

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
500	3effb892745cd228114d9e02a097d638.exe
500	3effb892745cd228114d9e02a097d638.exe
2120	WerFault.exe
2120	WerFault.exe
2120	WerFault.exe
2120	WerFault.exe
2120	WerFault.exe
2120	WerFault.exe
2120	WerFault.exe
2120	WerFault.exe
2120	WerFault.exe
2120	WerFault.exe
2120	WerFault.exe
2120	WerFault.exe
2120	WerFault.exe
2120	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	500	3effb892745cd228114d9e02a097d638.exe
Token: SeRestorePrivilege	2120	WerFault.exe
Token: SeBackupPrivilege	2120	WerFault.exe
Token: SeDebugPrivilege	2120	WerFault.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 500 wrote to memory of 2624	500	3effb892745cd228114d9e02a097d638.exe	78
PID 500 wrote to memory of 2624	500	3effb892745cd228114d9e02a097d638.exe	78
PID 500 wrote to memory of 2624	500	3effb892745cd228114d9e02a097d638.exe	78
PID 500 wrote to memory of 2624	500	3effb892745cd228114d9e02a097d638.exe	78
PID 500 wrote to memory of 2624	500	3effb892745cd228114d9e02a097d638.exe	78
PID 500 wrote to memory of 2624	500	3effb892745cd228114d9e02a097d638.exe	78
PID 500 wrote to memory of 2624	500	3effb892745cd228114d9e02a097d638.exe	78
PID 500 wrote to memory of 2624	500	3effb892745cd228114d9e02a097d638.exe	78
PID 500 wrote to memory of 2624	500	3effb892745cd228114d9e02a097d638.exe	78

C:\Users\Admin\AppData\Local\Temp\3effb892745cd228114d9e02a097d638.exe
"C:\Users\Admin\AppData\Local\Temp\3effb892745cd228114d9e02a097d638.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:500
- C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
  "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
  2⤵
  - Executes dropped EXE
  PID:2624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 328
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/500-3-0x0000000000030000-0x0000000000031000-memory.dmp

Download

memory/500-5-0x00000000048D0000-0x00000000048D1000-memory.dmp

Download

memory/500-6-0x0000000002320000-0x000000000233E000-memory.dmp

Download

memory/500-7-0x00000000048A0000-0x00000000048A1000-memory.dmp

Download

memory/500-8-0x00000000072B0000-0x00000000072B1000-memory.dmp

Download

memory/500-9-0x0000000007490000-0x000000000749B000-memory.dmp

Download

memory/500-10-0x000000000B410000-0x000000000B411000-memory.dmp

Download

memory/500-2-0x0000000073190000-0x000000007387E000-memory.dmp

Download

memory/2120-16-0x0000000004270000-0x0000000004271000-memory.dmp

Download

memory/2624-15-0x0000000000430000-0x0000000000450000-memory.dmp

Download

memory/2624-14-0x0000000000430000-0x0000000000450000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads