azorult | 08a6193d0afc12de32573390251740b4b1d7a1af0b19ef0cc3a12c078db76449 | Triage

Analysis

max time kernel
13s
max time network
42s
platform
windows7_x64
resource
win7v20210408
submitted
21-07-2021 03:02

Sharing

Report Analysis Logs

General

Target

08A6193D0AFC12DE32573390251740B4B1D7A1AF0B19E.exe
Size

252KB
MD5

997f26e502eb7d3c839b71ab5e77a647
SHA1

1c6aaec928e5bcaa07c7ce00a253b618fa7320ba
SHA256

08a6193d0afc12de32573390251740b4b1d7a1af0b19ef0cc3a12c078db76449
SHA512

4a748b90c92e85eb38962a0866b5f4c060ae4e905884b607b3710e53c30a0bdaa972a47fb71d71049148cbfa5c00d7264464bc64f1fd9fef68092bc3d5a68434

Score

10^/10

azorult infostealer trojan

Malware Config

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

08A6193D0AFC12DE32573390251740B4B1D7A1AF0B19E.exe

description	pid	process	target process
PID 748 wrote to memory of 1316	748	08A6193D0AFC12DE32573390251740B4B1D7A1AF0B19E.exe	wermgr.exe
PID 748 wrote to memory of 1316	748	08A6193D0AFC12DE32573390251740B4B1D7A1AF0B19E.exe	wermgr.exe
PID 748 wrote to memory of 1316	748	08A6193D0AFC12DE32573390251740B4B1D7A1AF0B19E.exe	wermgr.exe
PID 748 wrote to memory of 1316	748	08A6193D0AFC12DE32573390251740B4B1D7A1AF0B19E.exe	wermgr.exe
PID 748 wrote to memory of 1316	748	08A6193D0AFC12DE32573390251740B4B1D7A1AF0B19E.exe	wermgr.exe
PID 748 wrote to memory of 1316	748	08A6193D0AFC12DE32573390251740B4B1D7A1AF0B19E.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\08A6193D0AFC12DE32573390251740B4B1D7A1AF0B19E.exe
"C:\Users\Admin\AppData\Local\Temp\08A6193D0AFC12DE32573390251740B4B1D7A1AF0B19E.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:748

C:\Windows\SysWOW64\wermgr.exe
"C:\Windows\System32\wermgr.exe"
2⤵
PID:1316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1316-60-0x0000000000000000-mapping.dmp

Download
memory/1316-61-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download