azorult | 136f34bf0924e403ad31351a90a26c3d91d86c9d9733ae2c119d1461b3958492

Analysis

max time kernel
141s
max time network
225s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 18:28

Target

136f34bf0924e403ad31351a90a26c3d91d86c9d9733ae2c119d1461b3958492.exe
Size

194KB
MD5

d383a77aed7e0bd1de37b48aca8f01ef
SHA1

3607766989599dc1014ee184c21298e8d22e8609
SHA256

136f34bf0924e403ad31351a90a26c3d91d86c9d9733ae2c119d1461b3958492
SHA512

f313de8e2d7576b7effb85a3fc2f63d3249fccc59471403c9f3c2c6cc831106b4541f93ca617db67acd32d75433b66dd40331375454249537a155055bc10359e
SSDEEP

3072:jI26cn0EWph0EdY5cHy2Id1fxO4uYLgGFuEfAduSnlVoJRDqP0WrWO8tS:M2P2ph0A0NLf8yYN0JhqFrWO8U

Score

10^/10

Family

azorult

http://horseliker.ac.ug/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4404-132-0x0000000000400000-0x0000000000752000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5076 4404 WerFault.exe 136f34bf0924e403ad31351a90a26c3d91d86c9d9733ae2c119d1461b3958492.exe

pid	pid_target	process	target process
5076	4404	WerFault.exe	136f34bf0924e403ad31351a90a26c3d91d86c9d9733ae2c119d1461b3958492.exe

C:\Users\Admin\AppData\Local\Temp\136f34bf0924e403ad31351a90a26c3d91d86c9d9733ae2c119d1461b3958492.exe
"C:\Users\Admin\AppData\Local\Temp\136f34bf0924e403ad31351a90a26c3d91d86c9d9733ae2c119d1461b3958492.exe"
1⤵
PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 1384
2⤵
- Program crash
PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4404 -ip 4404
1⤵
PID:316

memory/4404-132-0x0000000000400000-0x0000000000752000-memory.dmp

Filesize
3.3MB

Download
memory/4404-133-0x0000000000AF3000-0x0000000000B04000-memory.dmp

Filesize
68KB

Download
memory/4404-134-0x0000000000AF3000-0x0000000000B04000-memory.dmp

Filesize
68KB

Download
memory/4404-135-0x0000000000400000-0x0000000000752000-memory.dmp

Filesize
3.3MB

Download
memory/4404-136-0x0000000000400000-0x0000000000752000-memory.dmp

Filesize
3.3MB

Download
memory/4404-137-0x0000000000AF3000-0x0000000000B04000-memory.dmp

Filesize
68KB

Download
memory/4404-138-0x0000000000400000-0x0000000000752000-memory.dmp

Filesize
3.3MB

Download