Analysis

  • max time kernel
    91s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    23/05/2022, 01:49

General

  • Target

    37aa3833c138e4863d8df4066521ad81b920c5801663d7e7c9da8487f684db79.exe

  • Size

    1.4MB

  • MD5

    d0d83709bc59685b80a97eff453f2fa0

  • SHA1

    2b642a576e00f8bbe3272c65d7c11619b9590b48

  • SHA256

    37aa3833c138e4863d8df4066521ad81b920c5801663d7e7c9da8487f684db79

  • SHA512

    555555a12f53b775a58f7a2be5eb036bbbfb2ce602ef3fa0c33609205fe1d813151012d9cf348ea9b168b423e4e011f1a907d7603f6963d9e467ba9f6ac26d5c

Malware Config

Extracted

Family

azorult

C2

http://bl1we4t.xyz/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\37aa3833c138e4863d8df4066521ad81b920c5801663d7e7c9da8487f684db79.exe
    "C:\Users\Admin\AppData\Local\Temp\37aa3833c138e4863d8df4066521ad81b920c5801663d7e7c9da8487f684db79.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3472
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAJwAsACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAGgAZQBhAHYAZQBuAC4AZQB4AGUAJwA=
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4816
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      2⤵
        PID:3516
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        2⤵
          PID:4860

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/3472-130-0x0000000000430000-0x00000000005A0000-memory.dmp

              Filesize

              1.4MB

            • memory/3472-131-0x0000000005530000-0x0000000005AD4000-memory.dmp

              Filesize

              5.6MB

            • memory/3472-132-0x0000000004F80000-0x0000000005012000-memory.dmp

              Filesize

              584KB

            • memory/3472-133-0x0000000004F40000-0x0000000004F4A000-memory.dmp

              Filesize

              40KB

            • memory/4816-142-0x000000006FB00000-0x000000006FB4C000-memory.dmp

              Filesize

              304KB

            • memory/4816-146-0x0000000007050000-0x000000000705A000-memory.dmp

              Filesize

              40KB

            • memory/4816-137-0x0000000004C00000-0x0000000004C22000-memory.dmp

              Filesize

              136KB

            • memory/4816-138-0x0000000005520000-0x0000000005586000-memory.dmp

              Filesize

              408KB

            • memory/4816-139-0x0000000005680000-0x00000000056E6000-memory.dmp

              Filesize

              408KB

            • memory/4816-140-0x0000000005CE0000-0x0000000005CFE000-memory.dmp

              Filesize

              120KB

            • memory/4816-141-0x00000000062A0000-0x00000000062D2000-memory.dmp

              Filesize

              200KB

            • memory/4816-135-0x0000000002700000-0x0000000002736000-memory.dmp

              Filesize

              216KB

            • memory/4816-143-0x0000000006280000-0x000000000629E000-memory.dmp

              Filesize

              120KB

            • memory/4816-144-0x0000000007630000-0x0000000007CAA000-memory.dmp

              Filesize

              6.5MB

            • memory/4816-145-0x0000000006FE0000-0x0000000006FFA000-memory.dmp

              Filesize

              104KB

            • memory/4816-136-0x0000000004EF0000-0x0000000005518000-memory.dmp

              Filesize

              6.2MB

            • memory/4816-147-0x0000000007260000-0x00000000072F6000-memory.dmp

              Filesize

              600KB

            • memory/4816-148-0x0000000007210000-0x000000000721E000-memory.dmp

              Filesize

              56KB

            • memory/4816-149-0x0000000007320000-0x000000000733A000-memory.dmp

              Filesize

              104KB

            • memory/4816-150-0x0000000007300000-0x0000000007308000-memory.dmp

              Filesize

              32KB

            • memory/4860-153-0x0000000000400000-0x0000000000420000-memory.dmp

              Filesize

              128KB

            • memory/4860-155-0x0000000000400000-0x0000000000420000-memory.dmp

              Filesize

              128KB

            • memory/4860-156-0x0000000000400000-0x0000000000420000-memory.dmp

              Filesize

              128KB