azorult | 75a7f031deb62016e6969aad6843046437f907da4ff89c308d3522dfe0de648c

Analysis

max time kernel
92s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2024 23:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75a7f031deb62016e6969aad6843046437f907da4ff89c308d3522dfe0de648c.exe
Size

216KB
MD5

58847cfe4b2a6a59a1109fe58b1498b7
SHA1

3bb7c7d8197054a754855251f7fb9858ebfe2eab
SHA256

75a7f031deb62016e6969aad6843046437f907da4ff89c308d3522dfe0de648c
SHA512

7cda451a82937a503a8579f284a7f86284a4f4b18b2667c8509f42ae03da9e519596e59be0b5a73cb7d0973f19073de2afe704798d59ce4490cabe18a3e9e1e8
SSDEEP

3072:CbtniwG4+eQvnI3xj6YQDXfkLxKf5+9SE9A9CzZpSzDFRPGbgQcbHVY95/2D:CbtntG4+eSajYPuKf56cJNAgxc5eD

Score

10^/10

azorult discovery infostealer trojan

Malware Config

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Azorult family
azorult

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
3660	3448	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

75a7f031deb62016e6969aad6843046437f907da4ff89c308d3522dfe0de648c.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75a7f031deb62016e6969aad6843046437f907da4ff89c308d3522dfe0de648c.exe

C:\Users\Admin\AppData\Local\Temp\75a7f031deb62016e6969aad6843046437f907da4ff89c308d3522dfe0de648c.exe
"C:\Users\Admin\AppData\Local\Temp\75a7f031deb62016e6969aad6843046437f907da4ff89c308d3522dfe0de648c.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 1436
  2⤵
  - Program crash
  PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3448 -ip 3448
1⤵
PID:1992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3448-1-0x0000000000660000-0x0000000000760000-memory.dmp

Filesize
1024KB

Download
memory/3448-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3448-3-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3448-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download