azorult | 5374aad626881bb1e4cc36aba2096d8caa4fee0f5151eb9185940bd6869ae8b8 | Triage

Analysis

max time kernel
144s
max time network
144s
platform
windows10_x64
resource
win10v20210408
submitted
23-04-2021 19:27

Sharing

Report Analysis Logs

General

Target

bcd841a8eb53e76ddbd13ab4eb706837.exe
Size

112KB
MD5

bcd841a8eb53e76ddbd13ab4eb706837
SHA1

0a7bc2e345047c69c427ef4f25f2a016130fac62
SHA256

5374aad626881bb1e4cc36aba2096d8caa4fee0f5151eb9185940bd6869ae8b8
SHA512

fa5151c63d78ae773cf92ec4f926b9f7b08724c66d145b75d2e8ee163c3e648c44c5c110fc45567edcd5976b64eac45c0fc50d404b8e7de0bac4afb88d0b3f8f

Score

10^/10

azorult infostealer trojan

Malware Config

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3120 660 WerFault.exe bcd841a8eb53e76ddbd13ab4eb706837.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3120	WerFault.exe
3120	WerFault.exe
3120	WerFault.exe
3120	WerFault.exe
3120	WerFault.exe
3120	WerFault.exe
3120	WerFault.exe
3120	WerFault.exe
3120	WerFault.exe
3120	WerFault.exe
3120	WerFault.exe
3120	WerFault.exe
3120	WerFault.exe
3120	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3120 WerFault.exe
Token: SeBackupPrivilege 3120 WerFault.exe
Token: SeDebugPrivilege 3120 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bcd841a8eb53e76ddbd13ab4eb706837.exe
"C:\Users\Admin\AppData\Local\Temp\bcd841a8eb53e76ddbd13ab4eb706837.exe"
1⤵
PID:660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 660 -s 1236
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...