azorult | 890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49

Analysis

max time kernel
98s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 01:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe
Size

2.2MB
MD5

054a6eddefc70dff71e491106a8e64ce
SHA1

e3152b9548d852adc492ffe095e58b725e6fa159
SHA256

890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49
SHA512

27e69af7657da0b82951370eda4ca32b24a5b51ec090cc777380e19986fe39402b1a4cb8a96f96d838883e129dce8533e48a00dc57cf2f127c8aace464d2172f
SSDEEP

49152:NNiz0ztMs0jXUye9NqPJOu0NwYsZ+AiWLGgKTO6YFHSnr:+Izh0PhOukwYsZ+A+gKTO+r

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://195.245.112.115/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe

description	pid	process	target process
PID 2432 set thread context of 3120	2432	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4732 3120 WerFault.exe 890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe

pid	pid_target	process	target process
4732	3120	WerFault.exe	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe

description	pid	process
Token: SeDebugPrivilege	2432	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe
Token: SeDebugPrivilege	2432	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe

description	pid	process	target process
PID 2432 wrote to memory of 3120	2432	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe
PID 2432 wrote to memory of 3120	2432	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe
PID 2432 wrote to memory of 3120	2432	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe
PID 2432 wrote to memory of 3120	2432	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe
PID 2432 wrote to memory of 3120	2432	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe
PID 2432 wrote to memory of 3120	2432	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe
PID 2432 wrote to memory of 3120	2432	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe
PID 2432 wrote to memory of 3120	2432	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe
PID 2432 wrote to memory of 3120	2432	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe	890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe

C:\Users\Admin\AppData\Local\Temp\890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe
"C:\Users\Admin\AppData\Local\Temp\890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2432

C:\Users\Admin\AppData\Local\Temp\890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe
"C:\Users\Admin\AppData\Local\Temp\890df73a5c131dd74522fca2bad1b159663133afef6203ba03d310a423173e49.exe"
2⤵
PID:3120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 1308
3⤵
- Program crash
PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3120 -ip 3120
1⤵
PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2432-34-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-4901-0x00000000747D0000-0x0000000074F80000-memory.dmp

Filesize
7.7MB

Download
memory/2432-2-0x0000000005170000-0x000000000539A000-memory.dmp

Filesize
2.2MB

Download
memory/2432-3-0x0000000005950000-0x0000000005EF4000-memory.dmp

Filesize
5.6MB

Download
memory/2432-4-0x00000000053A0000-0x0000000005432000-memory.dmp

Filesize
584KB

Download
memory/2432-5-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-18-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-48-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-60-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-68-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-66-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-64-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-62-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-58-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-56-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-54-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-0-0x00000000747DE000-0x00000000747DF000-memory.dmp

Filesize
4KB

Download
memory/2432-50-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-46-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-44-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-40-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-38-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-30-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-1-0x00000000005E0000-0x000000000080E000-memory.dmp

Filesize
2.2MB

Download
memory/2432-52-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-28-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-42-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-36-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-26-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-24-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-22-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-20-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-16-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-14-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-10-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-8-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-6-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-12-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/2432-4891-0x00000000747D0000-0x0000000074F80000-memory.dmp

Filesize
7.7MB

Download
memory/2432-4892-0x00000000747D0000-0x0000000074F80000-memory.dmp

Filesize
7.7MB

Download
memory/2432-4893-0x0000000005630000-0x0000000005696000-memory.dmp

Filesize
408KB

Download
memory/2432-4894-0x00000000056A0000-0x00000000056EC000-memory.dmp

Filesize
304KB

Download
memory/2432-4895-0x0000000005750000-0x00000000057A4000-memory.dmp

Filesize
336KB

Download
memory/2432-32-0x0000000005170000-0x0000000005394000-memory.dmp

Filesize
2.1MB

Download
memory/3120-4900-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3120-4902-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download