azorult | 3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b

General

Target

3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe
Size

798KB
MD5

14ee6b16a392da9de8bbd6b0c029fbb1
SHA1

6a0a3d9f8ac115f025e06b7088450361c91aa28f
SHA256

3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b
SHA512

d2008e3ab5c563cff6addd368da684a922b27227ac97f2e5491030d2217fc78bbc3ff1137b2540dbcd9ca0f9cfd2852bb390349f82e502ad0914ea261d586316

Score

10^/10

azorult infostealer persistence suricata trojan

Malware Config

Extracted

Family

azorult

C2

http://avebx.gq/ff1/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
suricata: ET MALWARE AZORult Variant.4 Checkin M2
suricata: ET MALWARE AZORult Variant.4 Checkin M2
suricata
suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M4
suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M4
suricata

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Macromedia\\StikyNot.exe"	3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe

description	pid	process	target process
PID 1292 set thread context of 1508	1292	3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe	3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe

description	pid	process	target process
PID 1292 wrote to memory of 1508	1292	3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe	3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe
PID 1292 wrote to memory of 1508	1292	3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe	3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe
PID 1292 wrote to memory of 1508	1292	3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe	3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe
PID 1292 wrote to memory of 1508	1292	3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe	3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe
PID 1292 wrote to memory of 1508	1292	3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe	3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe
PID 1292 wrote to memory of 1508	1292	3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe	3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe
PID 1292 wrote to memory of 1508	1292	3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe	3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe
PID 1292 wrote to memory of 1508	1292	3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe	3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe
PID 1292 wrote to memory of 1508	1292	3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe	3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe

C:\Users\Admin\AppData\Local\Temp\3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe
"C:\Users\Admin\AppData\Local\Temp\3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1292

C:\Users\Admin\AppData\Local\Temp\3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe
"C:\Users\Admin\AppData\Local\Temp\3b56a17871edc0bbeaa64277877d4adeb1b3872e9e5e506e888244b13b3c374b.exe"
2⤵
PID:1508

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1292-54-0x0000000075721000-0x0000000075723000-memory.dmp

Filesize
8KB

Download
memory/1508-58-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1508-59-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1508-56-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1508-55-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1508-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1508-63-0x000000000041A1F8-mapping.dmp

Download
memory/1508-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1508-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1508-66-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1508-68-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads