azorult | 0f981debcc6e67dde58505fc76b59d00072e9b13237d1376fea5cf9f95e6e2ed

Analysis

max time kernel
117s
max time network
126s
platform
windows7_x64
resource
win7-en-20211208
submitted
08/02/2022, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO#58392117.exe
Size 404KB
Sample220208-d1c1mscfbp
SHA256 0f981debcc6e67dde58505fc76b59d00072e9b13237d1376fea5cf9f95e6e2ed
MD5 f80b19c4f5c977b44c26f2e7565b6896
SHA1 e244aa3c983313cdaf46b0f94b74cadc2a570dbf
SHA512 f82cc566725783086293a02eb7140663e0105d338f9ac5047eb1cc13accceee4392ab081537104a5dab7e13dade6759e2a21722eea8e80a1a25aa6c32bcdb6a9
MD5 SHA1 SHA512

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://2.58.149.120/owes/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Loads dropped DLL 1 IoCs

pid	Process
1624	PO#58392117.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
268	1872	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
268	WerFault.exe
268	WerFault.exe
268	WerFault.exe
268	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
268	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	268	WerFault.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 1872	1624	PO#58392117.exe	27
PID 1624 wrote to memory of 1872	1624	PO#58392117.exe	27
PID 1624 wrote to memory of 1872	1624	PO#58392117.exe	27
PID 1624 wrote to memory of 1872	1624	PO#58392117.exe	27
PID 1624 wrote to memory of 1872	1624	PO#58392117.exe	27
PID 1624 wrote to memory of 1872	1624	PO#58392117.exe	27
PID 1624 wrote to memory of 1872	1624	PO#58392117.exe	27
PID 1624 wrote to memory of 1872	1624	PO#58392117.exe	27
PID 1624 wrote to memory of 1872	1624	PO#58392117.exe	27
PID 1624 wrote to memory of 1872	1624	PO#58392117.exe	27
PID 1624 wrote to memory of 1872	1624	PO#58392117.exe	27
PID 1872 wrote to memory of 268	1872	PO#58392117.exe	28
PID 1872 wrote to memory of 268	1872	PO#58392117.exe	28
PID 1872 wrote to memory of 268	1872	PO#58392117.exe	28
PID 1872 wrote to memory of 268	1872	PO#58392117.exe	28

C:\Users\Admin\AppData\Local\Temp\PO#58392117.exe
"C:\Users\Admin\AppData\Local\Temp\PO#58392117.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Users\Admin\AppData\Local\Temp\PO#58392117.exe
  "C:\Users\Admin\AppData\Local\Temp\PO#58392117.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 120
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-61-0x0000000000520000-0x0000000000521000-memory.dmp

Download

memory/1624-54-0x0000000076121000-0x0000000076123000-memory.dmp

Download

memory/1872-56-0x00000000001C0000-0x00000000001E0000-memory.dmp

Download

memory/1872-58-0x00000000001C0000-0x00000000001E0000-memory.dmp

Download