Analysis
-
max time kernel
157s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20/05/2022, 18:25
Static task
static1
Behavioral task
behavioral1
Sample
542daea836891972bb87d43e1a19d246f3e45cb8361f07cf149b420d76009c2b.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
542daea836891972bb87d43e1a19d246f3e45cb8361f07cf149b420d76009c2b.exe
Resource
win10v2004-20220414-en
General
-
Target
542daea836891972bb87d43e1a19d246f3e45cb8361f07cf149b420d76009c2b.exe
-
Size
199KB
-
MD5
e1c57a4f121b0f96b5278606610f6231
-
SHA1
78cc63b7323c3400b6ba99b476e226cf2536efb7
-
SHA256
542daea836891972bb87d43e1a19d246f3e45cb8361f07cf149b420d76009c2b
-
SHA512
0cede4d3158a3c1fe9a425b8ff35661b379103b5256bc5d94fc338476a3203922660659c2b7406b43806a01fe360b9658ba1799aa206eb9c00d3e78ba058f58a
Malware Config
Extracted
azorult
http://195.245.112.115/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1120 3080 WerFault.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\542daea836891972bb87d43e1a19d246f3e45cb8361f07cf149b420d76009c2b.exe"C:\Users\Admin\AppData\Local\Temp\542daea836891972bb87d43e1a19d246f3e45cb8361f07cf149b420d76009c2b.exe"1⤵PID:3080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 13882⤵
- Program crash
PID:1120
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3080 -ip 30801⤵PID:1764