azorult | 3b1fd9ce0c20b167a2367191a5129c5f635869f6a87f473cfe083e67d7f7465b

General

Target
3b1fd9ce0c20b167a2367191a5129c5f635869f6a87f473cfe083e67d7f7465b.exe
Size 337KB
Sample220520-jmpeeaghd2
SHA256 3b1fd9ce0c20b167a2367191a5129c5f635869f6a87f473cfe083e67d7f7465b
MD5 bce638f50587c46faa3c3e1798100251
SHA1 7b354d3902b1af13cc17cf4ec0c4da111309956d
SHA512 18445d9cd7bf41946817dae07652e2f4e9c0f14e98c90941c30b304fb70667aa79f4b5603f60d73bcd7bcca611bee7ac1d0601b278121c311de917b8e26e5c9f
MD5 SHA1 SHA512

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://89.43.107.198/mpom/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Executes dropped EXE 2 IoCs

pid	Process
4264	ucxgm.exe
4372	ucxgm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 4264	3148	3b1fd9ce0c20b167a2367191a5129c5f635869f6a87f473cfe083e67d7f7465b.exe	79
PID 3148 wrote to memory of 4264	3148	3b1fd9ce0c20b167a2367191a5129c5f635869f6a87f473cfe083e67d7f7465b.exe	79
PID 3148 wrote to memory of 4264	3148	3b1fd9ce0c20b167a2367191a5129c5f635869f6a87f473cfe083e67d7f7465b.exe	79
PID 4264 wrote to memory of 4372	4264	ucxgm.exe	80
PID 4264 wrote to memory of 4372	4264	ucxgm.exe	80
PID 4264 wrote to memory of 4372	4264	ucxgm.exe	80
PID 4264 wrote to memory of 4372	4264	ucxgm.exe	80
PID 4264 wrote to memory of 4372	4264	ucxgm.exe	80
PID 4264 wrote to memory of 4372	4264	ucxgm.exe	80
PID 4264 wrote to memory of 4372	4264	ucxgm.exe	80
PID 4264 wrote to memory of 4372	4264	ucxgm.exe	80
PID 4264 wrote to memory of 4372	4264	ucxgm.exe	80
PID 4264 wrote to memory of 4372	4264	ucxgm.exe	80

C:\Users\Admin\AppData\Local\Temp\3b1fd9ce0c20b167a2367191a5129c5f635869f6a87f473cfe083e67d7f7465b.exe
"C:\Users\Admin\AppData\Local\Temp\3b1fd9ce0c20b167a2367191a5129c5f635869f6a87f473cfe083e67d7f7465b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Users\Admin\AppData\Local\Temp\ucxgm.exe
  C:\Users\Admin\AppData\Local\Temp\ucxgm.exe C:\Users\Admin\AppData\Local\Temp\joszbi
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Users\Admin\AppData\Local\Temp\ucxgm.exe
    C:\Users\Admin\AppData\Local\Temp\ucxgm.exe C:\Users\Admin\AppData\Local\Temp\joszbi
    3⤵
    - Executes dropped EXE
    PID:4372

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

joszbi

Path C:\Users\Admin\AppData\Local\Temp\joszbi
Size 5KB
SHA256 5519ce10c332d304d521a15d902d84e2feac7827a148284713402de837fd4755
MD5 a5a523f60a17756e61e17ba513ff59d1
SHA1 d03b444c7c2d4ffb34d483427e69ec2116d90951
SHA512 99af33e2deb545c902c8663a67643b18ae2ee09924c8dee23c4ed93a6ff55305c020e3fd4e2d3781144450b14468c08799a3c59dfd1151893ec1a7e8352ef08d
SSDEEP 96:UMljubokkeL+BsCSYMmqvmBWUCtXZzuWDCSUTW7QNUCyyZ:LjQIsJvmBWRtXZzuTW7Q29u
MD5 SHA1 SHA512 SSDEEP

Submit Download

jqrvq39gj49la

Path C:\Users\Admin\AppData\Local\Temp\jqrvq39gj49la
Size 211KB
SHA256 466b28f6c18c530ac94410a111fe1feb84b2363b03831cb3e39af96d37ad56cd
MD5 664cb163be98c1035799694e2585cb16
SHA1 30984822dc25b065f6476557361396282906c551
SHA512 e723882a67c072413357da1d9950a363ffcdb38fd1554cfede3acc75a16b6b78497a736fed7c32a5b8431a4ce591d3610da561ebbfee03ce04d6661e32612985
SSDEEP 3072:q7+HTYgtB2LzfVIcJjVoi6EIAbZHAdFPBwieg2yO5FGr+ny4b3ucbiWcbfZhs5fG:3zxB2L5ZV/GFPBwLg2yKfnrpbIhCwz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ucxgm.exe

Path C:\Users\Admin\AppData\Local\Temp\ucxgm.exe
Size 179KB
SHA256 85f2460b17088ffbf8a4cfbbcf8c65340f538fe7e78603cf03adad566afc7838
MD5 78673699f5e78cf7ecfbb9ef42f3cc20
SHA1 7d1a1e230a595a3249f70871dfca54c1c7e6bb3e
SHA512 1f755d80bd66eea8ba8b0acbb9e2e8ba81d648671621ecd2407b680383e94269f7668840c9280dd75e176efb05cff25345438b43d3e82d71d9df865d759bb016
SSDEEP 3072:LRkMxoi0pXe9X11yHJqkc3xKLYBbIseNfIdQyQ+/vozm:LRcXe11oHJqlEbOR
MD5 SHA1 SHA512 SSDEEP

Submit Download

ucxgm.exe

Path C:\Users\Admin\AppData\Local\Temp\ucxgm.exe
Size 179KB
SHA256 85f2460b17088ffbf8a4cfbbcf8c65340f538fe7e78603cf03adad566afc7838
MD5 78673699f5e78cf7ecfbb9ef42f3cc20
SHA1 7d1a1e230a595a3249f70871dfca54c1c7e6bb3e
SHA512 1f755d80bd66eea8ba8b0acbb9e2e8ba81d648671621ecd2407b680383e94269f7668840c9280dd75e176efb05cff25345438b43d3e82d71d9df865d759bb016
SSDEEP 3072:LRkMxoi0pXe9X11yHJqkc3xKLYBbIseNfIdQyQ+/vozm:LRcXe11oHJqlEbOR
MD5 SHA1 SHA512 SSDEEP

Submit Download

ucxgm.exe

Path C:\Users\Admin\AppData\Local\Temp\ucxgm.exe
Size 179KB
SHA256 85f2460b17088ffbf8a4cfbbcf8c65340f538fe7e78603cf03adad566afc7838
MD5 78673699f5e78cf7ecfbb9ef42f3cc20
SHA1 7d1a1e230a595a3249f70871dfca54c1c7e6bb3e
SHA512 1f755d80bd66eea8ba8b0acbb9e2e8ba81d648671621ecd2407b680383e94269f7668840c9280dd75e176efb05cff25345438b43d3e82d71d9df865d759bb016
SSDEEP 3072:LRkMxoi0pXe9X11yHJqkc3xKLYBbIseNfIdQyQ+/vozm:LRcXe11oHJqlEbOR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4372-137-0x0000000000970000-0x0000000000990000-memory.dmp

Download

memory/4372-139-0x0000000000970000-0x0000000000990000-memory.dmp

Download

memory/4372-142-0x0000000000970000-0x0000000000990000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads