azorult | 5374aad626881bb1e4cc36aba2096d8caa4fee0f5151eb9185940bd6869ae8b8

Analysis

Target

5374aad626881bb1e4cc36aba2096d8caa4fee0f5151eb9185940bd6869ae8b8.exe
Size

112KB
MD5

bcd841a8eb53e76ddbd13ab4eb706837
SHA1

0a7bc2e345047c69c427ef4f25f2a016130fac62
SHA256

5374aad626881bb1e4cc36aba2096d8caa4fee0f5151eb9185940bd6869ae8b8
SHA512

fa5151c63d78ae773cf92ec4f926b9f7b08724c66d145b75d2e8ee163c3e648c44c5c110fc45567edcd5976b64eac45c0fc50d404b8e7de0bac4afb88d0b3f8f

Score

10^/10

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

432 1100 WerFault.exe 5374aad626881bb1e4cc36aba2096d8caa4fee0f5151eb9185940bd6869ae8b8.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

432 WerFault.exe
432 WerFault.exe
432 WerFault.exe
432 WerFault.exe
432 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

432 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 432 WerFault.exe

pid	pid_target	process	target process
432	1100	WerFault.exe	5374aad626881bb1e4cc36aba2096d8caa4fee0f5151eb9185940bd6869ae8b8.exe

pid	process
432	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	432	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5374aad626881bb1e4cc36aba2096d8caa4fee0f5151eb9185940bd6869ae8b8.exe

description	pid	process	target process
PID 1100 wrote to memory of 432	1100	5374aad626881bb1e4cc36aba2096d8caa4fee0f5151eb9185940bd6869ae8b8.exe	WerFault.exe
PID 1100 wrote to memory of 432	1100	5374aad626881bb1e4cc36aba2096d8caa4fee0f5151eb9185940bd6869ae8b8.exe	WerFault.exe
PID 1100 wrote to memory of 432	1100	5374aad626881bb1e4cc36aba2096d8caa4fee0f5151eb9185940bd6869ae8b8.exe	WerFault.exe
PID 1100 wrote to memory of 432	1100	5374aad626881bb1e4cc36aba2096d8caa4fee0f5151eb9185940bd6869ae8b8.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5374aad626881bb1e4cc36aba2096d8caa4fee0f5151eb9185940bd6869ae8b8.exe
"C:\Users\Admin\AppData\Local\Temp\5374aad626881bb1e4cc36aba2096d8caa4fee0f5151eb9185940bd6869ae8b8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 748
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:432

memory/432-61-0x0000000000000000-mapping.dmp

Download
memory/432-62-0x00000000002B0000-0x00000000002D0000-memory.dmp

Filesize
128KB

Download
memory/1100-60-0x0000000075A31000-0x0000000075A33000-memory.dmp

Filesize
8KB

Download