azorult | 98593b3bdf3d91fb46abd9d80cb246b01a276ee0a800c8c2d2bd99018d63b4ce | Triage

Analysis

max time kernel
136s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
14-05-2022 13:50

Sharing

Report Analysis Logs

General

Target

98593b3bdf3d91fb46abd9d80cb246b01a276ee0a800c8c2d2bd99018d63b4ce.exe
Size

245KB
MD5

82b5192c299f9ce14f4814a35f4daadd
SHA1

60f1d8276b1240cd46f965766168b933e8165a55
SHA256

98593b3bdf3d91fb46abd9d80cb246b01a276ee0a800c8c2d2bd99018d63b4ce
SHA512

79401dab3472ad3553abdb7c1c198f851cda845dda9a39012322b0ca99308cecf8bcd4544a99bbf5de1cee4ebe5de65c3e8dc6c442b2c4cb6aba18a25ce1819b

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://37.0.11.56/razor/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3188 4712 WerFault.exe 98593b3bdf3d91fb46abd9d80cb246b01a276ee0a800c8c2d2bd99018d63b4ce.exe

C:\Users\Admin\AppData\Local\Temp\98593b3bdf3d91fb46abd9d80cb246b01a276ee0a800c8c2d2bd99018d63b4ce.exe
"C:\Users\Admin\AppData\Local\Temp\98593b3bdf3d91fb46abd9d80cb246b01a276ee0a800c8c2d2bd99018d63b4ce.exe"
1⤵
PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 1440
2⤵
- Program crash
PID:3188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4712 -ip 4712
1⤵
PID:2632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4712-130-0x00000000007EE000-0x00000000007FF000-memory.dmp

Filesize
68KB

Download
memory/4712-131-0x0000000000590000-0x00000000005AD000-memory.dmp

Filesize
116KB

Download
memory/4712-132-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download