azorult | 4a4a4c441355bbf90def9ab2aec89335f93237487e670df04b3d63c65b5be25a | Triage

Analysis

max time kernel
78s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
21-05-2022 19:47

Sharing

Report Analysis Logs

General

Target

4a4a4c441355bbf90def9ab2aec89335f93237487e670df04b3d63c65b5be25a.exe
Size

270KB
MD5

4332f0c0baa163ca13506e81b24b25ea
SHA1

f43d4def1288ee50719aad128ee5cdc8b60c256e
SHA256

4a4a4c441355bbf90def9ab2aec89335f93237487e670df04b3d63c65b5be25a
SHA512

271de625607fb85050d8837cc907ae40735c9dfd0fa266f8eb6252ab3f04c7b9c4b16d39e79b098eda975bba9c362a07439c27b930f750640f4615d290059f12

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://136.144.41.124/razor/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4420 2192 WerFault.exe 4a4a4c441355bbf90def9ab2aec89335f93237487e670df04b3d63c65b5be25a.exe

C:\Users\Admin\AppData\Local\Temp\4a4a4c441355bbf90def9ab2aec89335f93237487e670df04b3d63c65b5be25a.exe
"C:\Users\Admin\AppData\Local\Temp\4a4a4c441355bbf90def9ab2aec89335f93237487e670df04b3d63c65b5be25a.exe"
1⤵
PID:2192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 1432
2⤵
- Program crash
PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2192 -ip 2192
1⤵
PID:4344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2192-130-0x00000000005F2000-0x0000000000603000-memory.dmp

Filesize
68KB

Download
memory/2192-132-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2192-131-0x0000000000500000-0x000000000051D000-memory.dmp

Filesize
116KB

Download