azorult | dcbd6522b7ba8bfb856038cf4dcb24782cab61a9e3ce15bbf9afcdff9c6c4f4a

Analysis

max time kernel
43s
max time network
140s
platform
windows7_x64
resource
win7v20210408
submitted
28-07-2021 03:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

034.exe
Size

391KB
MD5

2763355e57b326d3b984f0ac394f7ac6
SHA1

ceb54e6f4b044fe78e4acd5e2935831118d57baf
SHA256

dcbd6522b7ba8bfb856038cf4dcb24782cab61a9e3ce15bbf9afcdff9c6c4f4a
SHA512

6b402d5ee4ab1213ddd054f4478ff5cd81a01f75b9327fc8e3d09309cf42b811a998ae96ad0c3fe8ee8e2b9fce994f227ed3bdc74a1e7ae9658108061628e13a

Score

10^/10

azorult discovery infostealer suricata trojan

Malware Config

Extracted

Family

azorult

https://www.nirjhara.com/mine/32/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M1
suricata
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

034.exe

description pid process target process

PID 1488 set thread context of 292 1488 034.exe 034.exe

description	pid	process	target process
PID 1488 set thread context of 292	1488	034.exe	034.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

034.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	034.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	034.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

034.exe

pid process

292 034.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

034.exe

pid process

1488 034.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

034.exe

description pid process

Token: SeDebugPrivilege 1488 034.exe

pid	process
292	034.exe

pid	process
1488	034.exe

description	pid	process
Token: SeDebugPrivilege	1488	034.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

034.exe

description	pid	process	target process
PID 1488 wrote to memory of 292	1488	034.exe	034.exe
PID 1488 wrote to memory of 292	1488	034.exe	034.exe
PID 1488 wrote to memory of 292	1488	034.exe	034.exe
PID 1488 wrote to memory of 292	1488	034.exe	034.exe
PID 1488 wrote to memory of 292	1488	034.exe	034.exe

C:\Users\Admin\AppData\Local\Temp\034.exe
"C:\Users\Admin\AppData\Local\Temp\034.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488

C:\Users\Admin\AppData\Local\Temp\034.exe
"034.exe"
2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:292

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/292-65-0x000000000041A1F8-mapping.dmp

Download
memory/292-66-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1488-60-0x0000000000E60000-0x0000000000E61000-memory.dmp

Filesize
4KB

Download
memory/1488-62-0x00000000001F0000-0x0000000000215000-memory.dmp

Filesize
148KB

Download
memory/1488-63-0x00000000754F1000-0x00000000754F3000-memory.dmp

Filesize
8KB

Download
memory/1488-64-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download