azorult | a0b1de4908b9d668c9ad3c734d7f11b5369f297231718440deecae1b1d9e4870

General

Target

Purchase Order 07-01-20.exe
Size

286KB
MD5

cd7a513f32868e1b03028bbf13a92675
SHA1

f5e67231dabb339e227c25a0932a73ce07415b8c
SHA256

17436415138275ac49267782ae030b0919869d022f381ceec283b2838836c92f
SHA512

00e427f401340edbc34d1bc14fe9089de142beb723499380f6a6c4559859714a4e28ed28c460f52243164cc1a6aa391c9fa6223dd8c20d4aabf2a4ec7b5dbaaf

Score

10^/10

azorult infostealer suricata trojan

Malware Config

Extracted

Family

azorult

C2

https://www.nirjhara.com/mine/32/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
suricata: ET MALWARE AZORult Variant.4 Checkin M2
suricata: ET MALWARE AZORult Variant.4 Checkin M2
suricata
suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M4
suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M4
suricata
Suspicious use of SetThreadContext 1 IoCs

Processes:

Purchase Order 07-01-20.exe

description pid process target process

PID 1944 set thread context of 1804 1944 Purchase Order 07-01-20.exe Purchase Order 07-01-20.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

536 1804 WerFault.exe Purchase Order 07-01-20.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

640 schtasks.exe

description	pid	process	target process
PID 1944 set thread context of 1804	1944	Purchase Order 07-01-20.exe	Purchase Order 07-01-20.exe

pid	pid_target	process	target process
536	1804	WerFault.exe	Purchase Order 07-01-20.exe

pid	process
640	schtasks.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

Purchase Order 07-01-20.exePurchase Order 07-01-20.exe

description	pid	process	target process
PID 1944 wrote to memory of 640	1944	Purchase Order 07-01-20.exe	schtasks.exe
PID 1944 wrote to memory of 640	1944	Purchase Order 07-01-20.exe	schtasks.exe
PID 1944 wrote to memory of 640	1944	Purchase Order 07-01-20.exe	schtasks.exe
PID 1944 wrote to memory of 640	1944	Purchase Order 07-01-20.exe	schtasks.exe
PID 1944 wrote to memory of 1804	1944	Purchase Order 07-01-20.exe	Purchase Order 07-01-20.exe
PID 1944 wrote to memory of 1804	1944	Purchase Order 07-01-20.exe	Purchase Order 07-01-20.exe
PID 1944 wrote to memory of 1804	1944	Purchase Order 07-01-20.exe	Purchase Order 07-01-20.exe
PID 1944 wrote to memory of 1804	1944	Purchase Order 07-01-20.exe	Purchase Order 07-01-20.exe
PID 1944 wrote to memory of 1804	1944	Purchase Order 07-01-20.exe	Purchase Order 07-01-20.exe
PID 1944 wrote to memory of 1804	1944	Purchase Order 07-01-20.exe	Purchase Order 07-01-20.exe
PID 1944 wrote to memory of 1804	1944	Purchase Order 07-01-20.exe	Purchase Order 07-01-20.exe
PID 1944 wrote to memory of 1804	1944	Purchase Order 07-01-20.exe	Purchase Order 07-01-20.exe
PID 1944 wrote to memory of 1804	1944	Purchase Order 07-01-20.exe	Purchase Order 07-01-20.exe
PID 1944 wrote to memory of 1804	1944	Purchase Order 07-01-20.exe	Purchase Order 07-01-20.exe
PID 1804 wrote to memory of 536	1804	Purchase Order 07-01-20.exe	WerFault.exe
PID 1804 wrote to memory of 536	1804	Purchase Order 07-01-20.exe	WerFault.exe
PID 1804 wrote to memory of 536	1804	Purchase Order 07-01-20.exe	WerFault.exe
PID 1804 wrote to memory of 536	1804	Purchase Order 07-01-20.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Purchase Order 07-01-20.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order 07-01-20.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cmTotCm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3A05.tmp"
2⤵
- Creates scheduled task(s)
PID:640

C:\Users\Admin\AppData\Local\Temp\Purchase Order 07-01-20.exe
"{path}"
2⤵
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 860
3⤵
- Program crash
PID:536

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3A05.tmp
Filesize
1KB

MD5
f18eaf5fcd329b720c7c1cb495bef0c7

SHA1
a4c3f6a8b30a751793e2af23573e0cf00bacfd24

SHA256
61a0501d054b66daa970304b72d21e7323d00c8f9ed958915a41d2a4ae813d5f

SHA512
f9d632e30bc66e9bf139b4b6232fdfa383d42cb22fb7b84c65b110a868c5575f841065c1da40789938c44d5a792f38ef1193b7252e1cc11de438ce27a3e5103e

Download Submit
memory/536-73-0x0000000000000000-mapping.dmp

Download
memory/640-58-0x0000000000000000-mapping.dmp

Download
memory/1804-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1804-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1804-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1804-64-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1804-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1804-67-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1804-68-0x000000000041A1F8-mapping.dmp

Download
memory/1804-70-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1804-72-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1944-57-0x0000000001F90000-0x0000000001FBA000-memory.dmp

Filesize
168KB

Download
memory/1944-56-0x0000000000380000-0x0000000000388000-memory.dmp

Filesize
32KB

Download
memory/1944-54-0x0000000000130000-0x000000000017C000-memory.dmp

Filesize
304KB

Download
memory/1944-55-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads