azorult | 67ea2153cfc1a94642fa7f08b5e8c40c2497106687b6d9d6fa938eec1d659126

General

Target
67ea2153cfc1a94642fa7f08b5e8c40c2497106687b6d9d6fa938eec1d659126.exe
Size 341KB
Sample220520-yha4jschb6
SHA256 67ea2153cfc1a94642fa7f08b5e8c40c2497106687b6d9d6fa938eec1d659126
MD5 a8c8c9f845755c28d970990ac073386d
SHA1 ff23867b93b68d1feefcbea5fb5a96fc2b5870d1
SHA512 80a358958a39fed9fcf79d3b885a446f727ee89aad5e236074909a5677464c5cdabc8c3129bfb8c228556b8012a5cc54db46c28faf89ed3dff3e900c17ed2d2b
MD5 SHA1 SHA512

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://2.56.59.31/purelogs/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Executes dropped EXE 2 IoCs

pid	Process
1768	ibjyf.exe
1576	ibjyf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1768	1160	67ea2153cfc1a94642fa7f08b5e8c40c2497106687b6d9d6fa938eec1d659126.exe	81
PID 1160 wrote to memory of 1768	1160	67ea2153cfc1a94642fa7f08b5e8c40c2497106687b6d9d6fa938eec1d659126.exe	81
PID 1160 wrote to memory of 1768	1160	67ea2153cfc1a94642fa7f08b5e8c40c2497106687b6d9d6fa938eec1d659126.exe	81
PID 1768 wrote to memory of 1576	1768	ibjyf.exe	82
PID 1768 wrote to memory of 1576	1768	ibjyf.exe	82
PID 1768 wrote to memory of 1576	1768	ibjyf.exe	82
PID 1768 wrote to memory of 1576	1768	ibjyf.exe	82
PID 1768 wrote to memory of 1576	1768	ibjyf.exe	82
PID 1768 wrote to memory of 1576	1768	ibjyf.exe	82
PID 1768 wrote to memory of 1576	1768	ibjyf.exe	82
PID 1768 wrote to memory of 1576	1768	ibjyf.exe	82
PID 1768 wrote to memory of 1576	1768	ibjyf.exe	82
PID 1768 wrote to memory of 1576	1768	ibjyf.exe	82

C:\Users\Admin\AppData\Local\Temp\67ea2153cfc1a94642fa7f08b5e8c40c2497106687b6d9d6fa938eec1d659126.exe
"C:\Users\Admin\AppData\Local\Temp\67ea2153cfc1a94642fa7f08b5e8c40c2497106687b6d9d6fa938eec1d659126.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Users\Admin\AppData\Local\Temp\ibjyf.exe
  C:\Users\Admin\AppData\Local\Temp\ibjyf.exe C:\Users\Admin\AppData\Local\Temp\zjpvfl
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Users\Admin\AppData\Local\Temp\ibjyf.exe
    C:\Users\Admin\AppData\Local\Temp\ibjyf.exe C:\Users\Admin\AppData\Local\Temp\zjpvfl
    3⤵
    - Executes dropped EXE
    PID:1576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3rvv473x9d9doywn24w0

Path C:\Users\Admin\AppData\Local\Temp\3rvv473x9d9doywn24w0
Size 213KB
SHA256 e9db77d19a967335c3408db51f4c693cf663ed1d4c5c4f193b6d0bafe9049af5
MD5 d68efd53b46be72c468deb58e648d035
SHA1 2f7ce2bd0076bf6530905ee8863a93eed5feab56
SHA512 ec67672126fcf2a47ae4b845396121185c35791a6c5b024c33162ab0370f70fa6e7e101897c083b09b6c95ab36bf977abdb9f04e9cfbec4b98fff1c80c842c57
SSDEEP 6144:UkuSZRLLG3wXzslseoLKYrUV8v5IMdOVS3:UkuSZ51jslsXbUS1OVS3
MD5 SHA1 SHA512 SSDEEP

Submit Download

ibjyf.exe

Path C:\Users\Admin\AppData\Local\Temp\ibjyf.exe
Size 172KB
SHA256 23b900fff0fd487f6bd7770db56ec2a69248c2135a28fc7c017512f11798c1fa
MD5 3ce2e03927cfb19ced6be0d1a4df16b9
SHA1 67812421bfad08fa0d0ec9a6fa7341cab5687860
SHA512 0d9bfa9fdb6e038a56a938cb3237961b989d8da2d6813dbab0a575173d4c2c89c52a019cb4d7143521108e6cba79a4e8cb3128c15ac22c869a3b46f481bd8acc
SSDEEP 3072:guQSYHDXkI/CbGbcElC9eyRjRYAYMEqOVEmxOHN3B+Kwb:gujEDXVCb52CM81/1EqOak3
MD5 SHA1 SHA512 SSDEEP

Submit Download

ibjyf.exe

Path C:\Users\Admin\AppData\Local\Temp\ibjyf.exe
Size 172KB
SHA256 23b900fff0fd487f6bd7770db56ec2a69248c2135a28fc7c017512f11798c1fa
MD5 3ce2e03927cfb19ced6be0d1a4df16b9
SHA1 67812421bfad08fa0d0ec9a6fa7341cab5687860
SHA512 0d9bfa9fdb6e038a56a938cb3237961b989d8da2d6813dbab0a575173d4c2c89c52a019cb4d7143521108e6cba79a4e8cb3128c15ac22c869a3b46f481bd8acc
SSDEEP 3072:guQSYHDXkI/CbGbcElC9eyRjRYAYMEqOVEmxOHN3B+Kwb:gujEDXVCb52CM81/1EqOak3
MD5 SHA1 SHA512 SSDEEP

Submit Download

ibjyf.exe

Path C:\Users\Admin\AppData\Local\Temp\ibjyf.exe
Size 172KB
SHA256 23b900fff0fd487f6bd7770db56ec2a69248c2135a28fc7c017512f11798c1fa
MD5 3ce2e03927cfb19ced6be0d1a4df16b9
SHA1 67812421bfad08fa0d0ec9a6fa7341cab5687860
SHA512 0d9bfa9fdb6e038a56a938cb3237961b989d8da2d6813dbab0a575173d4c2c89c52a019cb4d7143521108e6cba79a4e8cb3128c15ac22c869a3b46f481bd8acc
SSDEEP 3072:guQSYHDXkI/CbGbcElC9eyRjRYAYMEqOVEmxOHN3B+Kwb:gujEDXVCb52CM81/1EqOak3
MD5 SHA1 SHA512 SSDEEP

Submit Download

zjpvfl

Path C:\Users\Admin\AppData\Local\Temp\zjpvfl
Size 5KB
SHA256 584c5e9c39032e13e4a22e10f6810c5a16eebd4e6176b7b10f60125de48946e2
MD5 ad4a34c660bd08739bde04685d83743c
SHA1 8930ea55e26562c033dca1c6aab8d50fb4bf786b
SHA512 ecd73bd232804a7940e2c211923fe504ff0ad857456f9cb68ebb0c164ead9f9c475c38c784a383461059dc355b7977d18b18078320332b32d2b99f7822351f4f
SSDEEP 96:ymUzPzPgQ7NJgLZxg38fP41HmKyl6zt52ZibFKsL2fEkcqk5Erm237BIK2otE:y1bzPgiHGzs8fP41GjoztfRKt7V2X
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1576-137-0x00000000003E0000-0x0000000000400000-memory.dmp

Download

memory/1576-139-0x00000000003E0000-0x0000000000400000-memory.dmp

Download

memory/1576-142-0x00000000003E0000-0x0000000000400000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads