azorult | c0741e25484d3ed9ab786a852564500602186b59638397ffbe37eab9182a7512 | Triage

Analysis

max time kernel
68s
max time network
135s
platform
windows10_x64
resource
win10v20210410
submitted
04-05-2021 13:01

Sharing

Report Analysis Logs

General

Target

FDEF96D4D036AE3DD5A1D87B6D04481D.exe
Size

112KB
MD5

fdef96d4d036ae3dd5a1d87b6d04481d
SHA1

cc8dc1dc65acacc01f262490b9f1952d07cf3124
SHA256

c0741e25484d3ed9ab786a852564500602186b59638397ffbe37eab9182a7512
SHA512

b242485aa77f736ba4ab789091f70d39ead8ab1326596e7233e8be2f1cd76a23ddf1d5f8ca91b069e339206e2dd65c846e4e9f52899aef72307d410634997165

Score

10^/10

azorult infostealer trojan

Malware Config

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3940 3876 WerFault.exe FDEF96D4D036AE3DD5A1D87B6D04481D.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3940 WerFault.exe
Token: SeBackupPrivilege 3940 WerFault.exe
Token: SeDebugPrivilege 3940 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\FDEF96D4D036AE3DD5A1D87B6D04481D.exe
"C:\Users\Admin\AppData\Local\Temp\FDEF96D4D036AE3DD5A1D87B6D04481D.exe"
1⤵
PID:3876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 1224
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...