azorult | 58139ab4dd0cf5931d900c6d7235fe0c08befe52a8362be21a8fb719c6dac0c8 | Triage

Analysis

max time kernel
15s
max time network
112s
platform
windows10_x64
resource
win10v20210408
submitted
27-07-2021 13:54

Sharing

Report Analysis Logs

General

Target

08a6193d0afc12de32573390251740b4b1d7a1af0b19ef0cc3a12c078db76449.exe
Size

252KB
MD5

997f26e502eb7d3c839b71ab5e77a647
SHA1

1c6aaec928e5bcaa07c7ce00a253b618fa7320ba
SHA256

08a6193d0afc12de32573390251740b4b1d7a1af0b19ef0cc3a12c078db76449
SHA512

4a748b90c92e85eb38962a0866b5f4c060ae4e905884b607b3710e53c30a0bdaa972a47fb71d71049148cbfa5c00d7264464bc64f1fd9fef68092bc3d5a68434

Score

10^/10

azorult infostealer suricata trojan

Malware Config

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M16
suricata

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

08a6193d0afc12de32573390251740b4b1d7a1af0b19ef0cc3a12c078db76449.exe

description	pid	process	target process
PID 656 wrote to memory of 936	656	08a6193d0afc12de32573390251740b4b1d7a1af0b19ef0cc3a12c078db76449.exe	wermgr.exe
PID 656 wrote to memory of 936	656	08a6193d0afc12de32573390251740b4b1d7a1af0b19ef0cc3a12c078db76449.exe	wermgr.exe
PID 656 wrote to memory of 936	656	08a6193d0afc12de32573390251740b4b1d7a1af0b19ef0cc3a12c078db76449.exe	wermgr.exe
PID 656 wrote to memory of 936	656	08a6193d0afc12de32573390251740b4b1d7a1af0b19ef0cc3a12c078db76449.exe	wermgr.exe
PID 656 wrote to memory of 936	656	08a6193d0afc12de32573390251740b4b1d7a1af0b19ef0cc3a12c078db76449.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\08a6193d0afc12de32573390251740b4b1d7a1af0b19ef0cc3a12c078db76449.exe
"C:\Users\Admin\AppData\Local\Temp\08a6193d0afc12de32573390251740b4b1d7a1af0b19ef0cc3a12c078db76449.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:656

C:\Windows\SysWOW64\wermgr.exe
"C:\Windows\System32\wermgr.exe"
2⤵
PID:936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/936-114-0x0000000000000000-mapping.dmp

Download