azorult | 8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5

General

Target
8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
Size 2.0MB
Sample201106-jyjnx9dev2
SHA256 8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5
MD5 f5037a6d17c3955dbeb73e5b2a3f6036
SHA1 c150c6d2da7536cecdd38850ad50ef0182ad2635
SHA512 4c80fb5f5b1345e53bac018535acf433c03a73f5169b44066ae2af32ae2d9480e30894444bb27da3eee79ed2b4f60e36f7023f122903b298717157f076f17d4a
MD5 SHA1 SHA512

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://0x21.in:8000/_az/

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

ServiceHost packer 7 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
behavioral1/memory/1520-42-0x0000000000000000-mapping.dmp	servicehost
behavioral1/memory/1520-45-0x0000000000000000-mapping.dmp	servicehost
behavioral1/memory/1520-49-0x0000000000000000-mapping.dmp	servicehost
behavioral1/memory/1520-53-0x0000000000000000-mapping.dmp	servicehost
behavioral1/memory/1520-54-0x0000000000000000-mapping.dmp	servicehost
behavioral1/memory/1520-55-0x0000000000000000-mapping.dmp	servicehost
behavioral1/memory/1520-57-0x0000000000000000-mapping.dmp	servicehost

Executes dropped EXE 2 IoCs

pid	Process
1528	vnc.exe
1968	windef.exe

Loads dropped DLL 8 IoCs

pid	Process
1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
File opened (read-only)	\??\r:	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
File opened (read-only)	\??\v:	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
File opened (read-only)	\??\z:	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
File opened (read-only)	\??\i:	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
File opened (read-only)	\??\j:	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
File opened (read-only)	\??\n:	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
File opened (read-only)	\??\m:	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
File opened (read-only)	\??\p:	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
File opened (read-only)	\??\y:	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
File opened (read-only)	\??\l:	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
File opened (read-only)	\??\o:	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
File opened (read-only)	\??\a:	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
File opened (read-only)	\??\e:	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
File opened (read-only)	\??\h:	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
File opened (read-only)	\??\k:	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
File opened (read-only)	\??\s:	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
File opened (read-only)	\??\t:	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
File opened (read-only)	\??\u:	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
File opened (read-only)	\??\w:	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
File opened (read-only)	\??\b:	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
File opened (read-only)	\??\f:	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
File opened (read-only)	\??\g:	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
File opened (read-only)	\??\x:	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ip-api.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1924 set thread context of 1816	1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe	29
PID 1528 set thread context of 1980	1528	vnc.exe	27

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1528	vnc.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1528	1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe	26
PID 1924 wrote to memory of 1528	1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe	26
PID 1924 wrote to memory of 1528	1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe	26
PID 1924 wrote to memory of 1528	1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe	26
PID 1528 wrote to memory of 1980	1528	vnc.exe	27
PID 1528 wrote to memory of 1980	1528	vnc.exe	27
PID 1528 wrote to memory of 1980	1528	vnc.exe	27
PID 1528 wrote to memory of 1980	1528	vnc.exe	27
PID 1528 wrote to memory of 1980	1528	vnc.exe	27
PID 1924 wrote to memory of 1968	1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe	28
PID 1924 wrote to memory of 1968	1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe	28
PID 1924 wrote to memory of 1968	1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe	28
PID 1924 wrote to memory of 1968	1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe	28
PID 1924 wrote to memory of 1816	1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe	29
PID 1924 wrote to memory of 1816	1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe	29
PID 1924 wrote to memory of 1816	1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe	29
PID 1924 wrote to memory of 1816	1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe	29
PID 1924 wrote to memory of 1816	1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe	29
PID 1924 wrote to memory of 1816	1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe	29
PID 1528 wrote to memory of 1980	1528	vnc.exe	27
PID 1528 wrote to memory of 1980	1528	vnc.exe	27
PID 1924 wrote to memory of 1780	1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe	30
PID 1924 wrote to memory of 1780	1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe	30
PID 1924 wrote to memory of 1780	1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe	30
PID 1924 wrote to memory of 1780	1924	8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe	30

C:\Users\Admin\AppData\Local\Temp\8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
"C:\Users\Admin\AppData\Local\Temp\8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Users\Admin\AppData\Local\Temp\vnc.exe
  "C:\Users\Admin\AppData\Local\Temp\vnc.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k
    3⤵
    - Maps connected drives based on registry
    PID:1980
- C:\Users\Admin\AppData\Local\Temp\windef.exe
  "C:\Users\Admin\AppData\Local\Temp\windef.exe"
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Users\Admin\AppData\Local\Temp\8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe
  "C:\Users\Admin\AppData\Local\Temp\8f2ad0a7a9bcd06a6f4dffe37c5bcba72e653f9752c2af2fd22176416cbe12b5.exe"
  2⤵
  PID:1816
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:1780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1424-37-0x0000000002120000-0x0000000002131000-memory.dmp

Download

memory/1424-58-0x0000000002840000-0x0000000002851000-memory.dmp

Download

memory/1520-29-0x0000000000E60000-0x0000000000E61000-memory.dmp

Download

memory/1520-28-0x0000000074090000-0x000000007477E000-memory.dmp

Download

memory/1528-18-0x00000000000F0000-0x000000000018C000-memory.dmp

Download

memory/1664-86-0x0000000000980000-0x0000000000981000-memory.dmp

Download

memory/1664-84-0x0000000074090000-0x000000007477E000-memory.dmp

Download

memory/1700-20-0x000007FEF6270000-0x000007FEF64EA000-memory.dmp

Download

memory/1816-14-0x0000000000080000-0x00000000000A0000-memory.dmp

Download

memory/1844-63-0x0000000074090000-0x000000007477E000-memory.dmp

Download

memory/1968-21-0x0000000001310000-0x0000000001311000-memory.dmp

Download

memory/1968-17-0x0000000074090000-0x000000007477E000-memory.dmp

Download

memory/1996-88-0x0000000000270000-0x000000000030C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads