azorult | c0741e25484d3ed9ab786a852564500602186b59638397ffbe37eab9182a7512

Analysis

Target

c0741e25484d3ed9ab786a852564500602186b59638397ffbe37eab9182a7512.exe
Size

112KB
MD5

fdef96d4d036ae3dd5a1d87b6d04481d
SHA1

cc8dc1dc65acacc01f262490b9f1952d07cf3124
SHA256

c0741e25484d3ed9ab786a852564500602186b59638397ffbe37eab9182a7512
SHA512

b242485aa77f736ba4ab789091f70d39ead8ab1326596e7233e8be2f1cd76a23ddf1d5f8ca91b069e339206e2dd65c846e4e9f52899aef72307d410634997165

Score

10^/10

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1044 1848 WerFault.exe c0741e25484d3ed9ab786a852564500602186b59638397ffbe37eab9182a7512.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1044 WerFault.exe
1044 WerFault.exe
1044 WerFault.exe
1044 WerFault.exe
1044 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1044 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1044 WerFault.exe

pid	pid_target	process	target process
1044	1848	WerFault.exe	c0741e25484d3ed9ab786a852564500602186b59638397ffbe37eab9182a7512.exe

pid	process
1044	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1044	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c0741e25484d3ed9ab786a852564500602186b59638397ffbe37eab9182a7512.exe

description	pid	process	target process
PID 1848 wrote to memory of 1044	1848	c0741e25484d3ed9ab786a852564500602186b59638397ffbe37eab9182a7512.exe	WerFault.exe
PID 1848 wrote to memory of 1044	1848	c0741e25484d3ed9ab786a852564500602186b59638397ffbe37eab9182a7512.exe	WerFault.exe
PID 1848 wrote to memory of 1044	1848	c0741e25484d3ed9ab786a852564500602186b59638397ffbe37eab9182a7512.exe	WerFault.exe
PID 1848 wrote to memory of 1044	1848	c0741e25484d3ed9ab786a852564500602186b59638397ffbe37eab9182a7512.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c0741e25484d3ed9ab786a852564500602186b59638397ffbe37eab9182a7512.exe
"C:\Users\Admin\AppData\Local\Temp\c0741e25484d3ed9ab786a852564500602186b59638397ffbe37eab9182a7512.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1848

memory/1044-61-0x0000000000000000-mapping.dmp

Download
memory/1044-62-0x00000000002C0000-0x00000000002E0000-memory.dmp

Filesize
128KB

Download
memory/1848-60-0x00000000757C1000-0x00000000757C3000-memory.dmp

Filesize
8KB

Download