9d6611c2779316f1ef4b4a6edcfdfb5e770fe32b31ec2200df268c3bd236ed75 | Triage

Analysis

max time kernel
78s
max time network
123s
platform
windows10_x64
resource
win10-en-20210920
submitted
21-10-2021 15:58

Sharing

Report Analysis Logs

General

Target

azorult_cpp.bin.exe
Size

79KB
MD5

5b26880f80a00397bc379caf5cadc564
SHA1

2de82ffa5833efbeb1c625f7be06a65c9814626d
SHA256

9d6611c2779316f1ef4b4a6edcfdfb5e770fe32b31ec2200df268c3bd236ed75
SHA512

ccb0e6e4a78277a620d91cfde608e48a91ca1eaf945071f5e1c8561a31abb7b85f2cc0acd4dee2002c21e173d25a2d4f4b47c25361c58adea06312bcf9132337

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

664 2712 WerFault.exe azorult_cpp.bin.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
664	WerFault.exe
664	WerFault.exe
664	WerFault.exe
664	WerFault.exe
664	WerFault.exe
664	WerFault.exe
664	WerFault.exe
664	WerFault.exe
664	WerFault.exe
664	WerFault.exe
664	WerFault.exe
664	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 664 WerFault.exe
Token: SeBackupPrivilege 664 WerFault.exe
Token: SeDebugPrivilege 664 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\azorult_cpp.bin.exe
"C:\Users\Admin\AppData\Local\Temp\azorult_cpp.bin.exe"
1⤵
PID:2712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 1320
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...