azorult | 655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66

General

Target

655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Size

294KB
MD5

a42e195a8a3de45dc2bc88e33af006a4
SHA1

1ce81ed627893bb2cb4aa83b008dcd10c9203dae
SHA256

655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66
SHA512

2a08c7e3110e080d2377e7e25f7cc3f1ff936ceb5e59f5f763955578b68cafe10b8d260a6b3147d0bd6d127774a298181bca8ad6256f40a42318df31756de90c

Score

10^/10

spyware discovery trojan infostealer azorult

Malware Config

Extracted

Family

azorult

C2

http://217.160.254.33/index.php

Signatures

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

Processes:

655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe

description	pid	process	target process
PID 1032 set thread context of 1856	1032	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Checks for installed software on the system 1 TTPs 30 IoCs

discovery

Query Registry

T1012

Processes:

655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key opened	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe

Loads dropped DLL 16 IoCs

Processes:

655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe

pid	process
1856	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
1856	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
1856	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
1856	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
1856	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
1856	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
1856	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
1856	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
1856	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
1856	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
1856	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
1856	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
1856	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
1856	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
1856	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
1856	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe

description	pid	process	target process
PID 1032 wrote to memory of 1840	1032	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
PID 1032 wrote to memory of 1840	1032	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
PID 1032 wrote to memory of 1840	1032	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
PID 1032 wrote to memory of 1840	1032	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
PID 1032 wrote to memory of 1856	1032	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
PID 1032 wrote to memory of 1856	1032	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
PID 1032 wrote to memory of 1856	1032	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
PID 1032 wrote to memory of 1856	1032	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
PID 1032 wrote to memory of 1856	1032	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
PID 1032 wrote to memory of 1856	1032	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
PID 1032 wrote to memory of 1856	1032	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
PID 1032 wrote to memory of 1856	1032	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
PID 1032 wrote to memory of 1856	1032	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
PID 1032 wrote to memory of 1856	1032	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe

description pid process

Token: SeDebugPrivilege 1032 655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe

description	pid	process
Token: SeDebugPrivilege	1032	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe

pid	process
1032	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
1856	655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe

C:\Users\Admin\AppData\Local\Temp\655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
"C:\Users\Admin\AppData\Local\Temp\655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1032

C:\Users\Admin\AppData\Local\Temp\655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
"{path}"
2⤵
PID:1840

C:\Users\Admin\AppData\Local\Temp\655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
"{path}"
2⤵
- Checks for installed software on the system
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\2fda\api-ms-win-crt-convert-l1-1-0.dll

Download Submit
\Users\Admin\AppData\Local\Temp\2fda\api-ms-win-crt-environment-l1-1-0.dll

Download Submit
\Users\Admin\AppData\Local\Temp\2fda\api-ms-win-crt-filesystem-l1-1-0.dll

Download Submit
\Users\Admin\AppData\Local\Temp\2fda\api-ms-win-crt-heap-l1-1-0.dll

Download Submit
\Users\Admin\AppData\Local\Temp\2fda\api-ms-win-crt-locale-l1-1-0.dll

Download Submit
\Users\Admin\AppData\Local\Temp\2fda\api-ms-win-crt-math-l1-1-0.dll

Download Submit
\Users\Admin\AppData\Local\Temp\2fda\api-ms-win-crt-multibyte-l1-1-0.dll

Download Submit
\Users\Admin\AppData\Local\Temp\2fda\api-ms-win-crt-runtime-l1-1-0.dll

Download Submit
\Users\Admin\AppData\Local\Temp\2fda\api-ms-win-crt-stdio-l1-1-0.dll

Download Submit
\Users\Admin\AppData\Local\Temp\2fda\api-ms-win-crt-string-l1-1-0.dll

Download Submit
\Users\Admin\AppData\Local\Temp\2fda\api-ms-win-crt-time-l1-1-0.dll

Download Submit
\Users\Admin\AppData\Local\Temp\2fda\api-ms-win-crt-utility-l1-1-0.dll

Download Submit
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll

Download Submit
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll

Download Submit
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll

Download Submit
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll

Download Submit
memory/1032-1-0x0000000000000000-0x0000000000000000-disk.dmp

Download
memory/1856-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1856-3-0x000000000041A1F8-mapping.dmp

Download
memory/1856-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads