azorult | 2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13

General

Target

2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe
Size

88KB
MD5

7e61b2b7856c264f9f70ccaef847494c
SHA1

aa0c219b24a943d0276cb98c3bd6237f24dd6887
SHA256

2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13
SHA512

60b26c9acb0379fa8cb272eeac46d5a08766e5a00389121091ec66d255a5b2d1e4903346e963e097df6b88378e201b44f31d1bfc2117d3d9efc40e90284d5508

Score

10^/10

azorult infostealer trojan

Malware Config

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Executes dropped EXE 1 IoCs

Processes:

fdsf.exe

pid process

916 fdsf.exe

pid	process
916	fdsf.exe

Checks QEMU agent state file 2 TTPs 2 IoCs

Checks state file used by QEMU agent, possibly to detect virtualization.

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe

description	ioc	process
File opened (read-only)	C:\ProgramData\qemu-ga\qga.state	2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe
File opened (read-only)	C:\ProgramData\qemu-ga\qga.state	2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe

pid	process
2536	2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe
428	2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe
428	2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe

description	pid	process	target process
PID 2536 set thread context of 428	2536	2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe	2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1412 916 WerFault.exe fdsf.exe

pid	pid_target	process	target process
1412	916	WerFault.exe	fdsf.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1412	WerFault.exe
1412	WerFault.exe
1412	WerFault.exe
1412	WerFault.exe
1412	WerFault.exe
1412	WerFault.exe
1412	WerFault.exe
1412	WerFault.exe
1412	WerFault.exe
1412	WerFault.exe
1412	WerFault.exe
1412	WerFault.exe
1412	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe

pid process

2536 2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1412 WerFault.exe
Token: SeBackupPrivilege 1412 WerFault.exe
Token: SeDebugPrivilege 1412 WerFault.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe

pid process

2536 2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe

description	pid	process
Token: SeRestorePrivilege	1412	WerFault.exe
Token: SeBackupPrivilege	1412	WerFault.exe
Token: SeDebugPrivilege	1412	WerFault.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe

description	pid	process	target process
PID 2536 wrote to memory of 428	2536	2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe	2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe
PID 2536 wrote to memory of 428	2536	2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe	2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe
PID 2536 wrote to memory of 428	2536	2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe	2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe
PID 2536 wrote to memory of 428	2536	2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe	2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe
PID 428 wrote to memory of 916	428	2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe	fdsf.exe
PID 428 wrote to memory of 916	428	2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe	fdsf.exe
PID 428 wrote to memory of 916	428	2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe	fdsf.exe

C:\Users\Admin\AppData\Local\Temp\2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe
"C:\Users\Admin\AppData\Local\Temp\2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe"
1⤵
- Checks QEMU agent state file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536

C:\Users\Admin\AppData\Local\Temp\2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe
"C:\Users\Admin\AppData\Local\Temp\2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13.exe"
2⤵
- Checks QEMU agent state file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:428

C:\Users\Admin\AppData\Local\Temp\fdsf.exe
"C:\Users\Admin\AppData\Local\Temp\fdsf.exe"
3⤵
- Executes dropped EXE
PID:916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 1108
4⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1412

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

1

T1012

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fdsf.exe
MD5
788fe4e8bdcff1069a879664b02410ec

SHA1
3931f99406bf4f8e5320bfd8c3b89a5fdc7b0d55

SHA256
fdf5e4a689691a96bf93bc3b34b6368b1902a5413980def6a864a57f0325ef4f

SHA512
b63d2495f737e0b6f58e0b25b5ca03280c6db4abbc9ca06a78192930cdea6586a3864daad819320c932915b81b55d1f0136726097e11c5b831cbf1944b354384

Download Submit
C:\Users\Admin\AppData\Local\Temp\fdsf.exe
MD5
788fe4e8bdcff1069a879664b02410ec

SHA1
3931f99406bf4f8e5320bfd8c3b89a5fdc7b0d55

SHA256
fdf5e4a689691a96bf93bc3b34b6368b1902a5413980def6a864a57f0325ef4f

SHA512
b63d2495f737e0b6f58e0b25b5ca03280c6db4abbc9ca06a78192930cdea6586a3864daad819320c932915b81b55d1f0136726097e11c5b831cbf1944b354384

Download Submit
memory/1412-4-0x00000000044C0000-0x00000000044C1000-memory.dmp

Filesize
4KB

Download
memory/1412-5-0x0000000004D00000-0x0000000004D01000-memory.dmp

Filesize
4KB

Download
memory/1412-6-0x0000000005100000-0x0000000005101000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads