azorult | fb64982d0bee9d86ecd9ddca94b51091f146f2c77ac622c4b4c9908080ed7324

Analysis

max time kernel
90s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
05-02-2024 08:58

Target

9192c2363847689ba2d28c05c4c04c6c.exe
Size

684KB
MD5

9192c2363847689ba2d28c05c4c04c6c
SHA1

b3f174d14b24967a0d95b293731ec013d9831e91
SHA256

fb64982d0bee9d86ecd9ddca94b51091f146f2c77ac622c4b4c9908080ed7324
SHA512

866aa56306feb9b12f2dc82a33931f79fa1bdb742ad868a8bc02358bd9a04cb1e32ced13eb028469d94fc0f8d314b31f82bfc9e2a5094dafe3fe2e48f90fe90f
SSDEEP

6144:QaW9qkTX/Q6SZ70111uX5KNYGo0KyDsZuRczFcut7BKzFCY1A/QrmsblRZQT2cV:QaW9qMX/TzuXCzXDUO8ptgzMYTmsbHU

Score

10^/10

Family

azorult

http://37.0.10.102/rut/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

9192c2363847689ba2d28c05c4c04c6c.exe

description pid process target process

PID 1332 set thread context of 4932 1332 9192c2363847689ba2d28c05c4c04c6c.exe 9192c2363847689ba2d28c05c4c04c6c.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1624 4932 WerFault.exe 9192c2363847689ba2d28c05c4c04c6c.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

9192c2363847689ba2d28c05c4c04c6c.exe

pid process

1332 9192c2363847689ba2d28c05c4c04c6c.exe
1332 9192c2363847689ba2d28c05c4c04c6c.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

9192c2363847689ba2d28c05c4c04c6c.exe

description pid process

Token: SeDebugPrivilege 1332 9192c2363847689ba2d28c05c4c04c6c.exe

description	pid	process	target process
PID 1332 set thread context of 4932	1332	9192c2363847689ba2d28c05c4c04c6c.exe	9192c2363847689ba2d28c05c4c04c6c.exe

pid	pid_target	process	target process
1624	4932	WerFault.exe	9192c2363847689ba2d28c05c4c04c6c.exe

pid	process
1332	9192c2363847689ba2d28c05c4c04c6c.exe
1332	9192c2363847689ba2d28c05c4c04c6c.exe

description	pid	process
Token: SeDebugPrivilege	1332	9192c2363847689ba2d28c05c4c04c6c.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

9192c2363847689ba2d28c05c4c04c6c.exe

description	pid	process	target process
PID 1332 wrote to memory of 4932	1332	9192c2363847689ba2d28c05c4c04c6c.exe	9192c2363847689ba2d28c05c4c04c6c.exe
PID 1332 wrote to memory of 4932	1332	9192c2363847689ba2d28c05c4c04c6c.exe	9192c2363847689ba2d28c05c4c04c6c.exe
PID 1332 wrote to memory of 4932	1332	9192c2363847689ba2d28c05c4c04c6c.exe	9192c2363847689ba2d28c05c4c04c6c.exe
PID 1332 wrote to memory of 4932	1332	9192c2363847689ba2d28c05c4c04c6c.exe	9192c2363847689ba2d28c05c4c04c6c.exe
PID 1332 wrote to memory of 4932	1332	9192c2363847689ba2d28c05c4c04c6c.exe	9192c2363847689ba2d28c05c4c04c6c.exe
PID 1332 wrote to memory of 4932	1332	9192c2363847689ba2d28c05c4c04c6c.exe	9192c2363847689ba2d28c05c4c04c6c.exe
PID 1332 wrote to memory of 4932	1332	9192c2363847689ba2d28c05c4c04c6c.exe	9192c2363847689ba2d28c05c4c04c6c.exe
PID 1332 wrote to memory of 4932	1332	9192c2363847689ba2d28c05c4c04c6c.exe	9192c2363847689ba2d28c05c4c04c6c.exe
PID 1332 wrote to memory of 4932	1332	9192c2363847689ba2d28c05c4c04c6c.exe	9192c2363847689ba2d28c05c4c04c6c.exe

C:\Users\Admin\AppData\Local\Temp\9192c2363847689ba2d28c05c4c04c6c.exe
"C:\Users\Admin\AppData\Local\Temp\9192c2363847689ba2d28c05c4c04c6c.exe"
2⤵
PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 364
3⤵
- Program crash
PID:1624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4932 -ip 4932
1⤵
PID:2384

memory/1332-6-0x00000000069C0000-0x00000000069F8000-memory.dmp

Filesize
224KB

Download
memory/1332-0-0x0000000000770000-0x0000000000822000-memory.dmp

Filesize
712KB

Download
memory/1332-2-0x0000000005890000-0x0000000005E34000-memory.dmp

Filesize
5.6MB

Download
memory/1332-3-0x0000000005200000-0x0000000005292000-memory.dmp

Filesize
584KB

Download
memory/1332-4-0x0000000005380000-0x000000000541C000-memory.dmp

Filesize
624KB

Download
memory/1332-5-0x0000000005500000-0x0000000005510000-memory.dmp

Filesize
64KB

Download
memory/1332-1-0x00000000751F0000-0x00000000759A0000-memory.dmp

Filesize
7.7MB

Download
memory/1332-7-0x0000000005500000-0x0000000005510000-memory.dmp

Filesize
64KB

Download
memory/1332-17-0x00000000751F0000-0x00000000759A0000-memory.dmp

Filesize
7.7MB

Download
memory/1332-9-0x0000000004CA0000-0x0000000004CA6000-memory.dmp

Filesize
24KB

Download
memory/1332-8-0x0000000004C80000-0x0000000004C94000-memory.dmp

Filesize
80KB

Download
memory/4932-13-0x00000000007A0000-0x00000000007C0000-memory.dmp

Filesize
128KB

Download
memory/4932-11-0x00000000007A0000-0x00000000007C0000-memory.dmp

Filesize
128KB

Download
memory/4932-18-0x00000000007A0000-0x00000000007C0000-memory.dmp

Filesize
128KB

Download