azorult | 3c020a1e304915e460a8b1524dacbaac804b9753d3d0fc36d34ded0e3baefb02

General

Target

3c020a1e304915e460a8b1524dacbaac804b9753d3d0fc36d34ded0e3baefb02.exe
Size

1.8MB
MD5

b6c77f545813f551ac34090023543a28
SHA1

974ac311cc5effc58bc911f4da286bc77884fab4
SHA256

3c020a1e304915e460a8b1524dacbaac804b9753d3d0fc36d34ded0e3baefb02
SHA512

37f6f90e58010e21fa08b3a3522fe6756b8a93a31c46c5fec12457d70de61b8dad754b1e5dc99c44c4c301365bb0eb7ef577c82549349b54902c1f760e8feb36

Score

10^/10

azorult infostealer persistence trojan upx

Malware Config

Extracted

Family

azorult

C2

http://begurtyut.info/743862/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Executes dropped EXE 2 IoCs

Processes:

TVwrd.exeTVwrd.exe

pid process

904 TVwrd.exe
952 TVwrd.exe

pid	process
904	TVwrd.exe
952	TVwrd.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\TVwrd.exe	upx
C:\Users\Admin\AppData\Local\TVwrd.exe	upx
C:\Users\Admin\AppData\Local\TVwrd.exe	upx
behavioral1/memory/904-70-0x0000000000400000-0x000000000047A000-memory.dmp	upx
C:\Users\Admin\AppData\Local\TVwrd.exe	upx

Loads dropped DLL 1 IoCs

Processes:

3c020a1e304915e460a8b1524dacbaac804b9753d3d0fc36d34ded0e3baefb02.exe

pid process

1972 3c020a1e304915e460a8b1524dacbaac804b9753d3d0fc36d34ded0e3baefb02.exe

pid	process
1972	3c020a1e304915e460a8b1524dacbaac804b9753d3d0fc36d34ded0e3baefb02.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

TVwrd.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\ozhiju = "C:\\Users\\Admin\\AppData\\Local\\ozhiju\\ztqqo.exe"	TVwrd.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

TVwrd.exe

description pid process target process

PID 904 set thread context of 952 904 TVwrd.exe TVwrd.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

TVwrd.exe

pid process

904 TVwrd.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

TVwrd.exe

pid process

904 TVwrd.exe

description	pid	process	target process
PID 904 set thread context of 952	904	TVwrd.exe	TVwrd.exe

pid	process
904	TVwrd.exe

pid	process
904	TVwrd.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

3c020a1e304915e460a8b1524dacbaac804b9753d3d0fc36d34ded0e3baefb02.exeTVwrd.exe

description	pid	process	target process
PID 1972 wrote to memory of 904	1972	3c020a1e304915e460a8b1524dacbaac804b9753d3d0fc36d34ded0e3baefb02.exe	TVwrd.exe
PID 1972 wrote to memory of 904	1972	3c020a1e304915e460a8b1524dacbaac804b9753d3d0fc36d34ded0e3baefb02.exe	TVwrd.exe
PID 1972 wrote to memory of 904	1972	3c020a1e304915e460a8b1524dacbaac804b9753d3d0fc36d34ded0e3baefb02.exe	TVwrd.exe
PID 1972 wrote to memory of 904	1972	3c020a1e304915e460a8b1524dacbaac804b9753d3d0fc36d34ded0e3baefb02.exe	TVwrd.exe
PID 904 wrote to memory of 952	904	TVwrd.exe	TVwrd.exe
PID 904 wrote to memory of 952	904	TVwrd.exe	TVwrd.exe
PID 904 wrote to memory of 952	904	TVwrd.exe	TVwrd.exe
PID 904 wrote to memory of 952	904	TVwrd.exe	TVwrd.exe
PID 904 wrote to memory of 952	904	TVwrd.exe	TVwrd.exe
PID 904 wrote to memory of 952	904	TVwrd.exe	TVwrd.exe
PID 904 wrote to memory of 952	904	TVwrd.exe	TVwrd.exe
PID 904 wrote to memory of 952	904	TVwrd.exe	TVwrd.exe
PID 904 wrote to memory of 952	904	TVwrd.exe	TVwrd.exe

C:\Users\Admin\AppData\Local\Temp\3c020a1e304915e460a8b1524dacbaac804b9753d3d0fc36d34ded0e3baefb02.exe
"C:\Users\Admin\AppData\Local\Temp\3c020a1e304915e460a8b1524dacbaac804b9753d3d0fc36d34ded0e3baefb02.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972

C:\Users\Admin\AppData\Local\TVwrd.exe
C:\Users\Admin\AppData\Local\TVwrd.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:904

C:\Users\Admin\AppData\Local\TVwrd.exe
C:\Users\Admin\AppData\Local\TVwrd.exe
3⤵
- Executes dropped EXE
PID:952

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\TVwrd.exe
Filesize
175KB

MD5
cfc18e99d10dcd9599cc2de6f5eb8b08

SHA1
3073bd62bbac0b08e40de50398aea9ecf2ca8fc4

SHA256
1653ebc2ed44e45055407730422b4a77f42e5d70de568515f315849b46ece0d3

SHA512
42daf2e80c7e5913095be3318d9f8c0a22569389923ffa73f40af24b729456047c93dd3598575d9b8c0076e232400d0cea46e9a91e9e77bf4bd3ffbc594312c6

Download Submit
C:\Users\Admin\AppData\Local\TVwrd.exe
Filesize
175KB

MD5
cfc18e99d10dcd9599cc2de6f5eb8b08

SHA1
3073bd62bbac0b08e40de50398aea9ecf2ca8fc4

SHA256
1653ebc2ed44e45055407730422b4a77f42e5d70de568515f315849b46ece0d3

SHA512
42daf2e80c7e5913095be3318d9f8c0a22569389923ffa73f40af24b729456047c93dd3598575d9b8c0076e232400d0cea46e9a91e9e77bf4bd3ffbc594312c6

Download Submit
C:\Users\Admin\AppData\Local\TVwrd.exe
Filesize
175KB

MD5
cfc18e99d10dcd9599cc2de6f5eb8b08

SHA1
3073bd62bbac0b08e40de50398aea9ecf2ca8fc4

SHA256
1653ebc2ed44e45055407730422b4a77f42e5d70de568515f315849b46ece0d3

SHA512
42daf2e80c7e5913095be3318d9f8c0a22569389923ffa73f40af24b729456047c93dd3598575d9b8c0076e232400d0cea46e9a91e9e77bf4bd3ffbc594312c6

Download Submit
C:\Users\Admin\AppData\Local\Tm.bmp
Filesize
737KB

MD5
e03bcd595ea51fd07bf8f98c3007d14a

SHA1
0dd53bc1469deb44eed0f515b5137a22ace4b652

SHA256
19b9b6bdd5424dd135460a5477899f009cffbe42045f829c35645551933e4bb4

SHA512
409954a90a764276242a6bbe24abff81ef5df9df0b8e949f23f3044c68e93e76ae9979a2e2696582f25899cb2d0fa10dd1de785b6dc5680381aa8b9ea49479a3

Download Submit
\Users\Admin\AppData\Local\TVwrd.exe
Filesize
175KB

MD5
cfc18e99d10dcd9599cc2de6f5eb8b08

SHA1
3073bd62bbac0b08e40de50398aea9ecf2ca8fc4

SHA256
1653ebc2ed44e45055407730422b4a77f42e5d70de568515f315849b46ece0d3

SHA512
42daf2e80c7e5913095be3318d9f8c0a22569389923ffa73f40af24b729456047c93dd3598575d9b8c0076e232400d0cea46e9a91e9e77bf4bd3ffbc594312c6

Download Submit
memory/904-70-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/904-56-0x0000000000000000-mapping.dmp

Download
memory/952-64-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/952-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/952-66-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/952-68-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/952-69-0x000000000041A1F8-mapping.dmp

Download
memory/952-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/952-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/952-73-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/952-75-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/952-76-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1972-54-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads