azorult | 5f955585f209598a9d7069fcdae436ac263121eace28f571b036b3730ee25c0f

Analysis

max time kernel
151s
max time network
162s
platform
windows7_x64
resource
win7-20220414-en
submitted
20/05/2022, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_626166155117636637099388377365355343431DT.exe
Size 599KB
Sample220520-2gvy4sader
SHA256 84c63913782658c1a3fe4c7c7f7bb9c2e09591ece6b7018ec3d48c7282582068
MD5 b58750b262ee79c332c554bc004702b2
SHA1 7f4a16ea0c530b6cb136efb2027632b624ca013d
SHA512 efb1ff89773ca35a5bfc9bf7472e7e8495870eec97905e2a17220a5e2b58371ff86ef77ed5f37f32d752fe4c679c1c3b03e79d62963e8906749db01a0b28f2ad
MD5 SHA1 SHA512

Score

10^/10

azorult evasion infostealer trojan

Malware Config

Extracted

Family

azorult

https://johnsonmeds.com/wp-admin/css/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	IMG_626166155117636637099388377365355343431DT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	IMG_626166155117636637099388377365355343431DT.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	IMG_626166155117636637099388377365355343431DT.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	IMG_626166155117636637099388377365355343431DT.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 904 set thread context of 1808	904	IMG_626166155117636637099388377365355343431DT.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1820	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
904	IMG_626166155117636637099388377365355343431DT.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	904	IMG_626166155117636637099388377365355343431DT.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 1820	904	IMG_626166155117636637099388377365355343431DT.exe	28
PID 904 wrote to memory of 1820	904	IMG_626166155117636637099388377365355343431DT.exe	28
PID 904 wrote to memory of 1820	904	IMG_626166155117636637099388377365355343431DT.exe	28
PID 904 wrote to memory of 1820	904	IMG_626166155117636637099388377365355343431DT.exe	28
PID 904 wrote to memory of 1808	904	IMG_626166155117636637099388377365355343431DT.exe	30
PID 904 wrote to memory of 1808	904	IMG_626166155117636637099388377365355343431DT.exe	30
PID 904 wrote to memory of 1808	904	IMG_626166155117636637099388377365355343431DT.exe	30
PID 904 wrote to memory of 1808	904	IMG_626166155117636637099388377365355343431DT.exe	30
PID 904 wrote to memory of 1808	904	IMG_626166155117636637099388377365355343431DT.exe	30
PID 904 wrote to memory of 1808	904	IMG_626166155117636637099388377365355343431DT.exe	30
PID 904 wrote to memory of 1808	904	IMG_626166155117636637099388377365355343431DT.exe	30
PID 904 wrote to memory of 1808	904	IMG_626166155117636637099388377365355343431DT.exe	30
PID 904 wrote to memory of 1808	904	IMG_626166155117636637099388377365355343431DT.exe	30
PID 904 wrote to memory of 1808	904	IMG_626166155117636637099388377365355343431DT.exe	30

C:\Users\Admin\AppData\Local\Temp\IMG_626166155117636637099388377365355343431DT.exe
"C:\Users\Admin\AppData\Local\Temp\IMG_626166155117636637099388377365355343431DT.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NNRdAuQNTwKy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCEB5.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1820
- C:\Users\Admin\AppData\Local\Temp\IMG_626166155117636637099388377365355343431DT.exe
  "C:\Users\Admin\AppData\Local\Temp\IMG_626166155117636637099388377365355343431DT.exe"
  2⤵
  PID:1808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpCEB5.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpCEB5.tmp
Size 1KB
SHA256 969d426436437de6dfe6fb0b0e78bcb1a4555cf4aa524cb2653cce2cfe5d6726
MD5 d51681d02d4cd335092cf6a8cf063317
SHA1 2dc9fe2c9379d11b5ef151a83f062253149d158f
SHA512 4b34fb91da9eb91b302adcad6843c9f4985b5769d7911335f6a997e1f38066faa2daeb38192be73b9640cfd43010ce5eb199d48e9bbb9dfda3b69370b4418375
MD5 SHA1 SHA512

Submit Download

memory/904-55-0x00000000764C1000-0x00000000764C3000-memory.dmp

Download

memory/904-56-0x0000000000580000-0x0000000000592000-memory.dmp

Download

memory/904-57-0x0000000000CB0000-0x0000000000CEC000-memory.dmp

Download

memory/904-58-0x0000000000BF0000-0x0000000000C14000-memory.dmp

Download

memory/904-54-0x0000000000DF0000-0x0000000000E8C000-memory.dmp

Download

memory/1808-64-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1808-61-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1808-65-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1808-62-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1808-66-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1808-68-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1808-71-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1808-73-0x0000000000400000-0x0000000000420000-memory.dmp

Download