azorult | f95d12a0dbd8199d16f48d8e4cbe69a8d4ec16c534efb36e52a662664e1c1783

Target

[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Size

9.2MB
MD5

b806267b5f3b7760df56396b1cf05e6d
SHA1

5166d4c1d3e476281d9e991eababc3e4aa9ec5ad
SHA256

f95d12a0dbd8199d16f48d8e4cbe69a8d4ec16c534efb36e52a662664e1c1783
SHA512

30e393bb3898edc8ab5fb04e62ce421ddf3903075f59e3880408b300f46bb74a85088336d6e1203b2101152cebeef4c1730290b41ca77604ecb722c8f627328b

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://kvaka.li/1210776429.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Executes dropped EXE 5 IoCs

pid	Process
1180	keygen-pr.exe
324	keygen-step-1.exe
524	keygen-step-3.exe
472	keygen-step-4.exe
1796	key.exe

Loads dropped DLL 10 IoCs

pid	Process
1608	cmd.exe
1608	cmd.exe
1608	cmd.exe
1608	cmd.exe
1608	cmd.exe
1180	keygen-pr.exe
1180	keygen-pr.exe
1180	keygen-pr.exe
1180	keygen-pr.exe
1796	key.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1428	PING.EXE

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1608	2004	[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe	29
PID 2004 wrote to memory of 1608	2004	[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe	29
PID 2004 wrote to memory of 1608	2004	[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe	29
PID 2004 wrote to memory of 1608	2004	[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe	29
PID 1608 wrote to memory of 1180	1608	cmd.exe	31
PID 1608 wrote to memory of 1180	1608	cmd.exe	31
PID 1608 wrote to memory of 1180	1608	cmd.exe	31
PID 1608 wrote to memory of 1180	1608	cmd.exe	31
PID 1608 wrote to memory of 1180	1608	cmd.exe	31
PID 1608 wrote to memory of 1180	1608	cmd.exe	31
PID 1608 wrote to memory of 1180	1608	cmd.exe	31
PID 1608 wrote to memory of 324	1608	cmd.exe	32
PID 1608 wrote to memory of 324	1608	cmd.exe	32
PID 1608 wrote to memory of 324	1608	cmd.exe	32
PID 1608 wrote to memory of 324	1608	cmd.exe	32
PID 1608 wrote to memory of 524	1608	cmd.exe	33
PID 1608 wrote to memory of 524	1608	cmd.exe	33
PID 1608 wrote to memory of 524	1608	cmd.exe	33
PID 1608 wrote to memory of 524	1608	cmd.exe	33
PID 1608 wrote to memory of 472	1608	cmd.exe	34
PID 1608 wrote to memory of 472	1608	cmd.exe	34
PID 1608 wrote to memory of 472	1608	cmd.exe	34
PID 1608 wrote to memory of 472	1608	cmd.exe	34
PID 1180 wrote to memory of 1796	1180	keygen-pr.exe	35
PID 1180 wrote to memory of 1796	1180	keygen-pr.exe	35
PID 1180 wrote to memory of 1796	1180	keygen-pr.exe	35
PID 1180 wrote to memory of 1796	1180	keygen-pr.exe	35
PID 1180 wrote to memory of 1796	1180	keygen-pr.exe	35
PID 1180 wrote to memory of 1796	1180	keygen-pr.exe	35
PID 1180 wrote to memory of 1796	1180	keygen-pr.exe	35
PID 1796 wrote to memory of 948	1796	key.exe	37
PID 1796 wrote to memory of 948	1796	key.exe	37
PID 1796 wrote to memory of 948	1796	key.exe	37
PID 1796 wrote to memory of 948	1796	key.exe	37
PID 1796 wrote to memory of 948	1796	key.exe	37
PID 1796 wrote to memory of 948	1796	key.exe	37
PID 1796 wrote to memory of 948	1796	key.exe	37
PID 524 wrote to memory of 616	524	keygen-step-3.exe	40
PID 524 wrote to memory of 616	524	keygen-step-3.exe	40
PID 524 wrote to memory of 616	524	keygen-step-3.exe	40
PID 524 wrote to memory of 616	524	keygen-step-3.exe	40
PID 616 wrote to memory of 1428	616	cmd.exe	39
PID 616 wrote to memory of 1428	616	cmd.exe	39
PID 616 wrote to memory of 1428	616	cmd.exe	39
PID 616 wrote to memory of 1428	616	cmd.exe	39

C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
"C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
    keygen-pr.exe -p83fsase3Ge
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1180
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1796
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
        5⤵
        
        PID:948
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
    keygen-step-1.exe
    3⤵
    - Executes dropped EXE
    PID:324
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
    keygen-step-3.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:524
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:616
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
    keygen-step-4.exe
    3⤵
    - Executes dropped EXE
    PID:472

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
1⤵
- Runs ping.exe
PID:1428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/472-25-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/784-38-0x000007FEF5D50000-0x000007FEF5FCA000-memory.dmp

Filesize
2.5MB

Download
memory/1796-41-0x00000000022A0000-0x000000000243C000-memory.dmp

Filesize
1.6MB

Download
memory/2004-2-0x0000000075EA1000-0x0000000075EA3000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General