azorult | 5374aad626881bb1e4cc36aba2096d8caa4fee0f5151eb9185940bd6869ae8b8

Analysis

Target

bcd841a8eb53e76ddbd13ab4eb706837.exe
Size

112KB
MD5

bcd841a8eb53e76ddbd13ab4eb706837
SHA1

0a7bc2e345047c69c427ef4f25f2a016130fac62
SHA256

5374aad626881bb1e4cc36aba2096d8caa4fee0f5151eb9185940bd6869ae8b8
SHA512

fa5151c63d78ae773cf92ec4f926b9f7b08724c66d145b75d2e8ee163c3e648c44c5c110fc45567edcd5976b64eac45c0fc50d404b8e7de0bac4afb88d0b3f8f

Score

10^/10

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1340 1920 WerFault.exe bcd841a8eb53e76ddbd13ab4eb706837.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1340 WerFault.exe
1340 WerFault.exe
1340 WerFault.exe
1340 WerFault.exe
1340 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1340 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1340 WerFault.exe

pid	pid_target	process	target process
1340	1920	WerFault.exe	bcd841a8eb53e76ddbd13ab4eb706837.exe

pid	process
1340	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1340	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bcd841a8eb53e76ddbd13ab4eb706837.exe

description	pid	process	target process
PID 1920 wrote to memory of 1340	1920	bcd841a8eb53e76ddbd13ab4eb706837.exe	WerFault.exe
PID 1920 wrote to memory of 1340	1920	bcd841a8eb53e76ddbd13ab4eb706837.exe	WerFault.exe
PID 1920 wrote to memory of 1340	1920	bcd841a8eb53e76ddbd13ab4eb706837.exe	WerFault.exe
PID 1920 wrote to memory of 1340	1920	bcd841a8eb53e76ddbd13ab4eb706837.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bcd841a8eb53e76ddbd13ab4eb706837.exe
"C:\Users\Admin\AppData\Local\Temp\bcd841a8eb53e76ddbd13ab4eb706837.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1920

memory/1340-61-0x0000000000000000-mapping.dmp

Download
memory/1340-62-0x00000000002D0000-0x00000000002F0000-memory.dmp

Filesize
128KB

Download
memory/1920-60-0x0000000076691000-0x0000000076693000-memory.dmp

Filesize
8KB

Download