azorult | 3bb9961490c803b6ff20959ab0c6b9c51863fd1c07b1778045a735d89e7e7287

General

Target

3bb9961490c803b6ff20959ab0c6b9c51863fd1c07b1778045a735d89e7e7287.exe
Size

3.3MB
MD5

4ce9eaf299a37158cf09d0e6847f27d5
SHA1

80fde74e771a40c4edc876cdd7f77be11ebed28f
SHA256

3bb9961490c803b6ff20959ab0c6b9c51863fd1c07b1778045a735d89e7e7287
SHA512

70e20c4326784cf8071817688f8166dd024e869e9faa04af644a4bd4b44b079d0036024bc2db84e3487c0823342ef8362a9a2ccd3c1cf51343e6f4e52ce91f50

Score

10^/10

azorult discovery infostealer suricata trojan

Malware Config

Extracted

Family

azorult

C2

http://92.63.192.72/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M15
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M15
suricata
Executes dropped EXE 2 IoCs

Processes:

busshost.exeYTLoader.exe

pid process

2252 busshost.exe
1620 YTLoader.exe

pid	process
2252	busshost.exe
1620	YTLoader.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3bb9961490c803b6ff20959ab0c6b9c51863fd1c07b1778045a735d89e7e7287.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	3bb9961490c803b6ff20959ab0c6b9c51863fd1c07b1778045a735d89e7e7287.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 4 IoCs

Processes:

3bb9961490c803b6ff20959ab0c6b9c51863fd1c07b1778045a735d89e7e7287.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\LetsSee!\YTLoader.exe	3bb9961490c803b6ff20959ab0c6b9c51863fd1c07b1778045a735d89e7e7287.exe
File opened for modification	C:\Program Files (x86)\LetsSee!\busshost.exe	3bb9961490c803b6ff20959ab0c6b9c51863fd1c07b1778045a735d89e7e7287.exe
File opened for modification	C:\Program Files (x86)\LetsSee!\Uninstall.exe	3bb9961490c803b6ff20959ab0c6b9c51863fd1c07b1778045a735d89e7e7287.exe
File created	C:\Program Files (x86)\LetsSee!\Uninstall.ini	3bb9961490c803b6ff20959ab0c6b9c51863fd1c07b1778045a735d89e7e7287.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4508 1620 WerFault.exe YTLoader.exe
4968 2252 WerFault.exe busshost.exe

pid	pid_target	process	target process
4508	1620	WerFault.exe	YTLoader.exe
4968	2252	WerFault.exe	busshost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

YTLoader.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	YTLoader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	YTLoader.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

YTLoader.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	YTLoader.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	YTLoader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	YTLoader.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

YTLoader.exe

description pid process

Token: SeDebugPrivilege 1620 YTLoader.exe

description	pid	process
Token: SeDebugPrivilege	1620	YTLoader.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

3bb9961490c803b6ff20959ab0c6b9c51863fd1c07b1778045a735d89e7e7287.exe

description	pid	process	target process
PID 2140 wrote to memory of 2252	2140	3bb9961490c803b6ff20959ab0c6b9c51863fd1c07b1778045a735d89e7e7287.exe	busshost.exe
PID 2140 wrote to memory of 2252	2140	3bb9961490c803b6ff20959ab0c6b9c51863fd1c07b1778045a735d89e7e7287.exe	busshost.exe
PID 2140 wrote to memory of 2252	2140	3bb9961490c803b6ff20959ab0c6b9c51863fd1c07b1778045a735d89e7e7287.exe	busshost.exe
PID 2140 wrote to memory of 1620	2140	3bb9961490c803b6ff20959ab0c6b9c51863fd1c07b1778045a735d89e7e7287.exe	YTLoader.exe
PID 2140 wrote to memory of 1620	2140	3bb9961490c803b6ff20959ab0c6b9c51863fd1c07b1778045a735d89e7e7287.exe	YTLoader.exe
PID 2140 wrote to memory of 1620	2140	3bb9961490c803b6ff20959ab0c6b9c51863fd1c07b1778045a735d89e7e7287.exe	YTLoader.exe

C:\Users\Admin\AppData\Local\Temp\3bb9961490c803b6ff20959ab0c6b9c51863fd1c07b1778045a735d89e7e7287.exe
"C:\Users\Admin\AppData\Local\Temp\3bb9961490c803b6ff20959ab0c6b9c51863fd1c07b1778045a735d89e7e7287.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2140

C:\Program Files (x86)\LetsSee!\busshost.exe
"C:\Program Files (x86)\LetsSee!\busshost.exe"
2⤵
- Executes dropped EXE
PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 1124
3⤵
- Program crash
PID:4968

C:\Program Files (x86)\LetsSee!\YTLoader.exe
"C:\Program Files (x86)\LetsSee!\YTLoader.exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 1608
3⤵
- Program crash
PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1620 -ip 1620
1⤵
PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2252 -ip 2252
1⤵
PID:2200

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

4

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\LetsSee!\YTLoader.exe
Filesize
3.0MB

MD5
c53d2de8becdaf58caba89a297455c65

SHA1
c60da079393025e63475683375e0a045cefa3473

SHA256
7d6eb1a70a0fc72adbcf03c05283b40e1ff656d655dbacf4e20fd6d635d46272

SHA512
a189cba278167f104ae0b27432b5c9a6153b2d8c3d0b6db82d5b71db7d23b9f0226519cc816ba0f5c360f9b029b0bef1636ab41f4ad742808824334e30f65878

Download Submit
C:\Program Files (x86)\LetsSee!\YTLoader.exe
Filesize
3.0MB

MD5
c53d2de8becdaf58caba89a297455c65

SHA1
c60da079393025e63475683375e0a045cefa3473

SHA256
7d6eb1a70a0fc72adbcf03c05283b40e1ff656d655dbacf4e20fd6d635d46272

SHA512
a189cba278167f104ae0b27432b5c9a6153b2d8c3d0b6db82d5b71db7d23b9f0226519cc816ba0f5c360f9b029b0bef1636ab41f4ad742808824334e30f65878

Download Submit
C:\Program Files (x86)\LetsSee!\busshost.exe
Filesize
294KB

MD5
866ce0f274ce18c79f4f98f7d73ddf52

SHA1
1508422c5831255f67e02f142bcb4266ba5d811f

SHA256
f2b2de78c5ab16b19eb538b08afae9d58f6eb6642cee4ca0405ba4e1fc776342

SHA512
ff225f6a95bf62cb17bc159e9d11cf6de5e9f93b0d3923cb2627bde206dbf89ef7cbdd2c0218b5a266790a31b9d8f010895b908cb93e1559715d192cf65be260

Download Submit
C:\Program Files (x86)\LetsSee!\busshost.exe
Filesize
294KB

MD5
866ce0f274ce18c79f4f98f7d73ddf52

SHA1
1508422c5831255f67e02f142bcb4266ba5d811f

SHA256
f2b2de78c5ab16b19eb538b08afae9d58f6eb6642cee4ca0405ba4e1fc776342

SHA512
ff225f6a95bf62cb17bc159e9d11cf6de5e9f93b0d3923cb2627bde206dbf89ef7cbdd2c0218b5a266790a31b9d8f010895b908cb93e1559715d192cf65be260

Download Submit
memory/1620-138-0x0000000004DE0000-0x0000000004DE8000-memory.dmp

Filesize
32KB

Download
memory/1620-144-0x0000000004E60000-0x0000000004E68000-memory.dmp

Filesize
32KB

Download
memory/1620-136-0x00000000000E0000-0x00000000003E8000-memory.dmp

Filesize
3.0MB

Download
memory/1620-137-0x0000000004DD0000-0x0000000004DDA000-memory.dmp

Filesize
40KB

Download
memory/1620-133-0x0000000000000000-mapping.dmp

Download
memory/1620-139-0x0000000004E00000-0x0000000004E08000-memory.dmp

Filesize
32KB

Download
memory/1620-140-0x0000000004E10000-0x0000000004E18000-memory.dmp

Filesize
32KB

Download
memory/1620-141-0x0000000004E20000-0x0000000004E28000-memory.dmp

Filesize
32KB

Download
memory/1620-142-0x0000000004E40000-0x0000000004E48000-memory.dmp

Filesize
32KB

Download
memory/1620-143-0x0000000004E50000-0x0000000004E58000-memory.dmp

Filesize
32KB

Download
memory/2252-130-0x0000000000000000-mapping.dmp

Download
memory/2252-145-0x0000000000524000-0x0000000000539000-memory.dmp

Filesize
84KB

Download
memory/2252-146-0x0000000000524000-0x0000000000539000-memory.dmp

Filesize
84KB

Download
memory/2252-147-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads