azorult | c0741e25484d3ed9ab786a852564500602186b59638397ffbe37eab9182a7512

Analysis

Target

FDEF96D4D036AE3DD5A1D87B6D04481D.exe
Size

112KB
MD5

fdef96d4d036ae3dd5a1d87b6d04481d
SHA1

cc8dc1dc65acacc01f262490b9f1952d07cf3124
SHA256

c0741e25484d3ed9ab786a852564500602186b59638397ffbe37eab9182a7512
SHA512

b242485aa77f736ba4ab789091f70d39ead8ab1326596e7233e8be2f1cd76a23ddf1d5f8ca91b069e339206e2dd65c846e4e9f52899aef72307d410634997165

Score

10^/10

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

640 1348 WerFault.exe FDEF96D4D036AE3DD5A1D87B6D04481D.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

640 WerFault.exe
640 WerFault.exe
640 WerFault.exe
640 WerFault.exe
640 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

640 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 640 WerFault.exe

pid	pid_target	process	target process
640	1348	WerFault.exe	FDEF96D4D036AE3DD5A1D87B6D04481D.exe

pid	process
640	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	640	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

FDEF96D4D036AE3DD5A1D87B6D04481D.exe

description	pid	process	target process
PID 1348 wrote to memory of 640	1348	FDEF96D4D036AE3DD5A1D87B6D04481D.exe	WerFault.exe
PID 1348 wrote to memory of 640	1348	FDEF96D4D036AE3DD5A1D87B6D04481D.exe	WerFault.exe
PID 1348 wrote to memory of 640	1348	FDEF96D4D036AE3DD5A1D87B6D04481D.exe	WerFault.exe
PID 1348 wrote to memory of 640	1348	FDEF96D4D036AE3DD5A1D87B6D04481D.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\FDEF96D4D036AE3DD5A1D87B6D04481D.exe
"C:\Users\Admin\AppData\Local\Temp\FDEF96D4D036AE3DD5A1D87B6D04481D.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1348

memory/640-61-0x0000000000000000-mapping.dmp

Download
memory/640-62-0x0000000001F10000-0x0000000001F11000-memory.dmp

Filesize
4KB

Download
memory/1348-60-0x00000000762C1000-0x00000000762C3000-memory.dmp

Filesize
8KB

Download