azorult | a1834bdd140fffb6f5132e298e8e8afeafa66c8e58f9b45d319d075b6198c563

Analysis

max time kernel
155s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 21:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1834bdd140fffb6f5132e298e8e8afeafa66c8e58f9b45d319d075b6198c563.exe
Size

281KB
MD5

4f5441dc226ef0dd830dbc15fc2bd94f
SHA1

01619dbdeee63be5b9a15c25d156893e8cb84917
SHA256

a1834bdd140fffb6f5132e298e8e8afeafa66c8e58f9b45d319d075b6198c563
SHA512

7d1672da612b79bd0d0527448f9a5810ad3901bd62f71a3a6c9b9a82e440d5026d49ae4ddef0aeb4e431a50ad3fa10fb24e021da08d13a34eb507218125776c8
SSDEEP

3072:WP+rpgJyUmp9+AbKNuiQ6QUwAmxCHV3X2oszmFvv45uMhX0Hc:+xJLmjiQ6VwAYAV3X2QxBMXU

Score

10^/10

azorult infostealer spyware stealer trojan

Malware Config

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
2780	4788	WerFault.exe	a1834bdd140fffb6f5132e298e8e8afeafa66c8e58f9b45d319d075b6198c563.exe
4420	4788	WerFault.exe	a1834bdd140fffb6f5132e298e8e8afeafa66c8e58f9b45d319d075b6198c563.exe

C:\Users\Admin\AppData\Local\Temp\a1834bdd140fffb6f5132e298e8e8afeafa66c8e58f9b45d319d075b6198c563.exe
"C:\Users\Admin\AppData\Local\Temp\a1834bdd140fffb6f5132e298e8e8afeafa66c8e58f9b45d319d075b6198c563.exe"
1⤵
PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 1376
2⤵
- Program crash
PID:2780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 1372
2⤵
- Program crash
PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4788 -ip 4788
1⤵
PID:368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4788 -ip 4788
1⤵
PID:4032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3792 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:4400

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4788-1-0x0000000001D10000-0x0000000001E10000-memory.dmp

Filesize
1024KB

Download
memory/4788-2-0x0000000001BD0000-0x0000000001BEE000-memory.dmp

Filesize
120KB

Download
memory/4788-3-0x0000000000400000-0x0000000001A32000-memory.dmp

Filesize
22.2MB

Download
memory/4788-4-0x0000000000400000-0x0000000001A32000-memory.dmp

Filesize
22.2MB

Download
memory/4788-5-0x0000000000400000-0x0000000001A32000-memory.dmp

Filesize
22.2MB

Download
memory/4788-6-0x0000000001D10000-0x0000000001E10000-memory.dmp

Filesize
1024KB

Download
memory/4788-7-0x0000000001BD0000-0x0000000001BEE000-memory.dmp

Filesize
120KB

Download
memory/4788-8-0x0000000000400000-0x0000000001A32000-memory.dmp

Filesize
22.2MB

Download