azorult | 890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 01:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe
Size

2.2MB
MD5

054a6eddefc70dff71e491106a8e64ce
SHA1

e3152b9548d852adc492ffe095e58b725e6fa159
SHA256

890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49
SHA512

27e69af7657da0b82951370eda4ca32b24a5b51ec090cc777380e19986fe39402b1a4cb8a96f96d838883e129dce8533e48a00dc57cf2f127c8aace464d2172f
SSDEEP

49152:NNiz0ztMs0jXUye9NqPJOu0NwYsZ+AiWLGgKTO6YFHSnr:+Izh0PhOukwYsZ+A+gKTO+r

Score

10^/10

azorult infostealer trojan

Malware Config

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe

description	pid	process	target process
PID 2104 set thread context of 2596	2104	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2760 2596 WerFault.exe 890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe

pid	pid_target	process	target process
2760	2596	WerFault.exe	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe

description	pid	process
Token: SeDebugPrivilege	2104	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe
Token: SeDebugPrivilege	2104	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe

description	pid	process	target process
PID 2104 wrote to memory of 2596	2104	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe
PID 2104 wrote to memory of 2596	2104	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe
PID 2104 wrote to memory of 2596	2104	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe
PID 2104 wrote to memory of 2596	2104	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe
PID 2104 wrote to memory of 2596	2104	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe
PID 2104 wrote to memory of 2596	2104	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe
PID 2104 wrote to memory of 2596	2104	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe
PID 2104 wrote to memory of 2596	2104	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe
PID 2104 wrote to memory of 2596	2104	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe
PID 2104 wrote to memory of 2596	2104	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe
PID 2596 wrote to memory of 2760	2596	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe	WerFault.exe
PID 2596 wrote to memory of 2760	2596	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe	WerFault.exe
PID 2596 wrote to memory of 2760	2596	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe	WerFault.exe
PID 2596 wrote to memory of 2760	2596	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe
"C:\Users\Admin\AppData\Local\Temp\890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104

C:\Users\Admin\AppData\Local\Temp\890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe
"C:\Users\Admin\AppData\Local\Temp\890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 704
3⤵
- Program crash
PID:2760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2104-0-0x0000000074BAE000-0x0000000074BAF000-memory.dmp

Filesize
4KB

Download
memory/2104-1-0x0000000001180000-0x00000000013AE000-memory.dmp

Filesize
2.2MB

Download
memory/2104-2-0x0000000004A90000-0x0000000004CBA000-memory.dmp

Filesize
2.2MB

Download
memory/2104-3-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-4-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-28-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-6-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-56-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-24-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-22-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-32-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-30-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-26-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-20-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-18-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-16-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-14-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-12-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-10-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-8-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-35-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-36-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-38-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-40-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-44-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-58-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-54-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-52-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-50-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-48-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-46-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-42-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-60-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-66-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-64-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-62-0x0000000004A90000-0x0000000004CB4000-memory.dmp

Filesize
2.1MB

Download
memory/2104-4890-0x0000000000D10000-0x0000000000D5C000-memory.dmp

Filesize
304KB

Download
memory/2104-4889-0x0000000004800000-0x0000000004866000-memory.dmp

Filesize
408KB

Download
memory/2104-4892-0x0000000074BA0000-0x000000007528E000-memory.dmp

Filesize
6.9MB

Download
memory/2104-4891-0x0000000074BA0000-0x000000007528E000-memory.dmp

Filesize
6.9MB

Download
memory/2104-4893-0x0000000004980000-0x00000000049D4000-memory.dmp

Filesize
336KB

Download
memory/2104-4907-0x0000000074BA0000-0x000000007528E000-memory.dmp

Filesize
6.9MB

Download