azorult | 4a4a4c441355bbf90def9ab2aec89335f93237487e670df04b3d63c65b5be25a

Analysis

max time kernel
128s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
14-05-2022 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a4a4c441355bbf90def9ab2aec89335f93237487e670df04b3d63c65b5be25a.exe
Size

270KB
MD5

4332f0c0baa163ca13506e81b24b25ea
SHA1

f43d4def1288ee50719aad128ee5cdc8b60c256e
SHA256

4a4a4c441355bbf90def9ab2aec89335f93237487e670df04b3d63c65b5be25a
SHA512

271de625607fb85050d8837cc907ae40735c9dfd0fa266f8eb6252ab3f04c7b9c4b16d39e79b098eda975bba9c362a07439c27b930f750640f4615d290059f12

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://136.144.41.124/razor/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Drops file in System32 directory 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{6230F73B-89E6-4695-B919-D9D5713DAD98}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{ED4ECDEB-B9FA-4D2F-8955-73B68842BE6D}.catalogItem	svchost.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4664 4076 WerFault.exe 4a4a4c441355bbf90def9ab2aec89335f93237487e670df04b3d63c65b5be25a.exe

pid	pid_target	process	target process
4664	4076	WerFault.exe	4a4a4c441355bbf90def9ab2aec89335f93237487e670df04b3d63c65b5be25a.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

C:\Users\Admin\AppData\Local\Temp\4a4a4c441355bbf90def9ab2aec89335f93237487e670df04b3d63c65b5be25a.exe
"C:\Users\Admin\AppData\Local\Temp\4a4a4c441355bbf90def9ab2aec89335f93237487e670df04b3d63c65b5be25a.exe"
1⤵
PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 1444
2⤵
- Program crash
PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4076 -ip 4076
1⤵
PID:2716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:1224

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4076-130-0x00000000004E2000-0x00000000004F3000-memory.dmp

Filesize
68KB

Download
memory/4076-131-0x00000000004B0000-0x00000000004CD000-memory.dmp

Filesize
116KB

Download
memory/4076-132-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download