azorult | ad7817be4e1f4a6b29eedb318a6963cfcdf1f844b05f94b14ed4be2b83faabea | Triage

Analysis

max time kernel
92s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2022 07:03

Sharing

Report Analysis Logs

General

Target

ad7817be4e1f4a6b29eedb318a6963cfcdf1f844b05f94b14ed4be2b83faabea.exe
Size

274KB
MD5

e5760c6a41a442d80369a7ce80a56000
SHA1

783e0d2a39bec3f5ad557a221e8ef77c9d02cbd5
SHA256

ad7817be4e1f4a6b29eedb318a6963cfcdf1f844b05f94b14ed4be2b83faabea
SHA512

281181c3d164177f9da29d8d13782b72b91675be2cd058154e8febc402abc5515c66a81b198cf5663e92d9e5eaa7a75e6c87b452a518941e403292dac9ba43b7

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://gersopakoftaronka.xyz/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2232 1340 WerFault.exe ad7817be4e1f4a6b29eedb318a6963cfcdf1f844b05f94b14ed4be2b83faabea.exe

C:\Users\Admin\AppData\Local\Temp\ad7817be4e1f4a6b29eedb318a6963cfcdf1f844b05f94b14ed4be2b83faabea.exe
"C:\Users\Admin\AppData\Local\Temp\ad7817be4e1f4a6b29eedb318a6963cfcdf1f844b05f94b14ed4be2b83faabea.exe"
1⤵
PID:1340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 728
  2⤵
  - Program crash
  PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1340 -ip 1340
1⤵
PID:4792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1340-130-0x00000000014AE000-0x00000000014BF000-memory.dmp

Filesize
68KB

Download
memory/1340-131-0x0000000000400000-0x00000000012CA000-memory.dmp

Filesize
14.8MB

Download