azorult | 6ff7947479912de1b93ea3dc430d871993d1deec9e68c7ba52f1bfe2fac95562

General

Target
Order Confirmation.exe
Size 737KB
Sample201012-3b617lrfla
SHA256 6ff7947479912de1b93ea3dc430d871993d1deec9e68c7ba52f1bfe2fac95562
MD5 b4a664cd81c1fccf3c416ae49d6f5b4d
SHA1 238d2ab0b15d58064f3cdc6ca5a57d103d4fad58
SHA512 0580df71994bfdeeff255e3db487a00fa54ab538fd1eb7e75f140a8244e72ddf0b21359f7335d24a2a073c569b7099d5edf94edf117b43608b793bd734a8cd2e
MD5 SHA1 SHA512

Score

10^/10

trojan infostealer azorult spyware

Malware Config

Extracted

Family

azorult

C2

http://64.137.176.70/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Loads dropped DLL 16 IoCs

pid	Process
1900	RegSvcs.exe
1900	RegSvcs.exe
1900	RegSvcs.exe
1900	RegSvcs.exe
1900	RegSvcs.exe
1900	RegSvcs.exe
1900	RegSvcs.exe
1900	RegSvcs.exe
1900	RegSvcs.exe
1900	RegSvcs.exe
1900	RegSvcs.exe
1900	RegSvcs.exe
1900	RegSvcs.exe
1900	RegSvcs.exe
1900	RegSvcs.exe
1900	RegSvcs.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral1/files/0x00030000000131fc-10.dat	js

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1164 set thread context of 1900	1164	Order Confirmation.exe	28

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegSvcs.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
744	timeout.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1164	Order Confirmation.exe
1164	Order Confirmation.exe
1900	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1164	Order Confirmation.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 1900	1164	Order Confirmation.exe	28
PID 1164 wrote to memory of 1900	1164	Order Confirmation.exe	28
PID 1164 wrote to memory of 1900	1164	Order Confirmation.exe	28
PID 1164 wrote to memory of 1900	1164	Order Confirmation.exe	28
PID 1164 wrote to memory of 1900	1164	Order Confirmation.exe	28
PID 1164 wrote to memory of 1900	1164	Order Confirmation.exe	28
PID 1164 wrote to memory of 1900	1164	Order Confirmation.exe	28
PID 1164 wrote to memory of 1900	1164	Order Confirmation.exe	28
PID 1164 wrote to memory of 1900	1164	Order Confirmation.exe	28
PID 1164 wrote to memory of 1900	1164	Order Confirmation.exe	28
PID 1164 wrote to memory of 1900	1164	Order Confirmation.exe	28
PID 1164 wrote to memory of 1900	1164	Order Confirmation.exe	28
PID 1164 wrote to memory of 1900	1164	Order Confirmation.exe	28
PID 1900 wrote to memory of 892	1900	RegSvcs.exe	31
PID 1900 wrote to memory of 892	1900	RegSvcs.exe	31
PID 1900 wrote to memory of 892	1900	RegSvcs.exe	31
PID 1900 wrote to memory of 892	1900	RegSvcs.exe	31
PID 892 wrote to memory of 744	892	cmd.exe	33
PID 892 wrote to memory of 744	892	cmd.exe	33
PID 892 wrote to memory of 744	892	cmd.exe	33
PID 892 wrote to memory of 744	892	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\Order Confirmation.exe
"C:\Users\Admin\AppData\Local\Temp\Order Confirmation.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegSvcs.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:892
  - - C:\Windows\SysWOW64\timeout.exe
      C:\Windows\system32\timeout.exe 3
      4⤵
      Delays execution with timeout.exe
      PID:744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

4

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

4

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1164-0-0x0000000074200000-0x00000000748EE000-memory.dmp

Download

memory/1164-5-0x00000000003F0000-0x000000000045A000-memory.dmp

Download

memory/1164-4-0x0000000004F10000-0x0000000004F8A000-memory.dmp

Download

memory/1164-3-0x0000000000760000-0x0000000000764000-memory.dmp

Download

memory/1164-1-0x0000000001160000-0x0000000001161000-memory.dmp

Download

memory/1900-8-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1900-6-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1964-9-0x000007FEF6BB0000-0x000007FEF6E2A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads