azorult | bd7b6ea0059f09b7e35d783a2809bbf58b68cc2572eede9f2dec032e5d686c4a

Analysis

Target

bd7b6ea0059f09b7e35d783a2809bbf58b68cc2572eede9f2dec032e5d686c4a.exe
Size

112KB
MD5

88ccc83d69e681eaf64c7e28f958c948
SHA1

8fa740e6f273e7f4b530cafa5808f00e7a90e8c4
SHA256

bd7b6ea0059f09b7e35d783a2809bbf58b68cc2572eede9f2dec032e5d686c4a
SHA512

8cfda23291621ddf1e1854210530d5f03407077c70097ec16d32d335f4bb2b1379d001838ea6ecd0ced5f2a728c5ee4ddd5ef7ae541b0d784e7bddcfcd1d0c86

Score

10^/10

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1528 1796 WerFault.exe bd7b6ea0059f09b7e35d783a2809bbf58b68cc2572eede9f2dec032e5d686c4a.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1528 WerFault.exe
1528 WerFault.exe
1528 WerFault.exe
1528 WerFault.exe
1528 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1528 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1528 WerFault.exe

pid	pid_target	process	target process
1528	1796	WerFault.exe	bd7b6ea0059f09b7e35d783a2809bbf58b68cc2572eede9f2dec032e5d686c4a.exe

pid	process
1528	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1528	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bd7b6ea0059f09b7e35d783a2809bbf58b68cc2572eede9f2dec032e5d686c4a.exe

description	pid	process	target process
PID 1796 wrote to memory of 1528	1796	bd7b6ea0059f09b7e35d783a2809bbf58b68cc2572eede9f2dec032e5d686c4a.exe	WerFault.exe
PID 1796 wrote to memory of 1528	1796	bd7b6ea0059f09b7e35d783a2809bbf58b68cc2572eede9f2dec032e5d686c4a.exe	WerFault.exe
PID 1796 wrote to memory of 1528	1796	bd7b6ea0059f09b7e35d783a2809bbf58b68cc2572eede9f2dec032e5d686c4a.exe	WerFault.exe
PID 1796 wrote to memory of 1528	1796	bd7b6ea0059f09b7e35d783a2809bbf58b68cc2572eede9f2dec032e5d686c4a.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bd7b6ea0059f09b7e35d783a2809bbf58b68cc2572eede9f2dec032e5d686c4a.exe
"C:\Users\Admin\AppData\Local\Temp\bd7b6ea0059f09b7e35d783a2809bbf58b68cc2572eede9f2dec032e5d686c4a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1796

memory/1528-61-0x0000000000000000-mapping.dmp

Download
memory/1528-62-0x0000000000760000-0x0000000000780000-memory.dmp

Filesize
128KB

Download
memory/1796-60-0x0000000076A01000-0x0000000076A03000-memory.dmp

Filesize
8KB

Download