azorult | bd7b6ea0059f09b7e35d783a2809bbf58b68cc2572eede9f2dec032e5d686c4a | Triage

Analysis

max time kernel
126s
max time network
128s
platform
windows10_x64
resource
win10v20210410
submitted
08-05-2021 21:43

Sharing

Report Analysis Logs

General

Target

bd7b6ea0059f09b7e35d783a2809bbf58b68cc2572eede9f2dec032e5d686c4a.exe
Size

112KB
MD5

88ccc83d69e681eaf64c7e28f958c948
SHA1

8fa740e6f273e7f4b530cafa5808f00e7a90e8c4
SHA256

bd7b6ea0059f09b7e35d783a2809bbf58b68cc2572eede9f2dec032e5d686c4a
SHA512

8cfda23291621ddf1e1854210530d5f03407077c70097ec16d32d335f4bb2b1379d001838ea6ecd0ced5f2a728c5ee4ddd5ef7ae541b0d784e7bddcfcd1d0c86

Score

10^/10

azorult infostealer trojan

Malware Config

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2808 1736 WerFault.exe bd7b6ea0059f09b7e35d783a2809bbf58b68cc2572eede9f2dec032e5d686c4a.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2808	WerFault.exe
2808	WerFault.exe
2808	WerFault.exe
2808	WerFault.exe
2808	WerFault.exe
2808	WerFault.exe
2808	WerFault.exe
2808	WerFault.exe
2808	WerFault.exe
2808	WerFault.exe
2808	WerFault.exe
2808	WerFault.exe
2808	WerFault.exe
2808	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2808 WerFault.exe
Token: SeBackupPrivilege 2808 WerFault.exe
Token: SeDebugPrivilege 2808 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bd7b6ea0059f09b7e35d783a2809bbf58b68cc2572eede9f2dec032e5d686c4a.exe
"C:\Users\Admin\AppData\Local\Temp\bd7b6ea0059f09b7e35d783a2809bbf58b68cc2572eede9f2dec032e5d686c4a.exe"
1⤵
PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 1228
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...