azorult | 7aaf2650f6e2914340ca5230eec2da557e4045ce9cf20ada8ba8e4d5d2228d7b

Analysis

max time kernel
142s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 03:49

Target

bfc540e107105f338e3ffd51684a95cb.exe
Size

398KB
MD5

bfc540e107105f338e3ffd51684a95cb
SHA1

69630788640cf3d13123cfddbbde88bbca1091c0
SHA256

7aaf2650f6e2914340ca5230eec2da557e4045ce9cf20ada8ba8e4d5d2228d7b
SHA512

22276b7b30c571c9d7a619196b21a22840652cbd21c59c0dc043485c3ddfc872081822d8bb091c3c76f1c6007000f6d9fe719ff330d6dfe4b13e276226d1f836
SSDEEP

12288:9+4txFPMBur44CyzbwNq0Lr/IJ+StcyM/CCM98:9+4hMA8pgIlLrwJ+bfvM98

Score

10^/10

Family

azorult

http://cwownola.org/AqwE/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

bfc540e107105f338e3ffd51684a95cb.exe

description pid process target process

PID 2500 set thread context of 1404 2500 bfc540e107105f338e3ffd51684a95cb.exe bfc540e107105f338e3ffd51684a95cb.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3356 1404 WerFault.exe bfc540e107105f338e3ffd51684a95cb.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

bfc540e107105f338e3ffd51684a95cb.exe

pid process

2500 bfc540e107105f338e3ffd51684a95cb.exe

description	pid	process	target process
PID 2500 set thread context of 1404	2500	bfc540e107105f338e3ffd51684a95cb.exe	bfc540e107105f338e3ffd51684a95cb.exe

pid	pid_target	process	target process
3356	1404	WerFault.exe	bfc540e107105f338e3ffd51684a95cb.exe

pid	process
2500	bfc540e107105f338e3ffd51684a95cb.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bfc540e107105f338e3ffd51684a95cb.exe

description	pid	process	target process
PID 2500 wrote to memory of 1404	2500	bfc540e107105f338e3ffd51684a95cb.exe	bfc540e107105f338e3ffd51684a95cb.exe
PID 2500 wrote to memory of 1404	2500	bfc540e107105f338e3ffd51684a95cb.exe	bfc540e107105f338e3ffd51684a95cb.exe
PID 2500 wrote to memory of 1404	2500	bfc540e107105f338e3ffd51684a95cb.exe	bfc540e107105f338e3ffd51684a95cb.exe
PID 2500 wrote to memory of 1404	2500	bfc540e107105f338e3ffd51684a95cb.exe	bfc540e107105f338e3ffd51684a95cb.exe

C:\Users\Admin\AppData\Local\Temp\bfc540e107105f338e3ffd51684a95cb.exe
"C:\Users\Admin\AppData\Local\Temp\bfc540e107105f338e3ffd51684a95cb.exe"
2⤵
PID:1404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 1784
3⤵
- Program crash
PID:3356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1404 -ip 1404
1⤵
PID:1552

memory/1404-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1404-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1404-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1404-18-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2500-1-0x0000000000AB0000-0x0000000000BB0000-memory.dmp

Filesize
1024KB

Download
memory/2500-2-0x0000000001010000-0x0000000001012000-memory.dmp

Filesize
8KB

Download