Overview

overview

10

Static

static

URLScan

urlscan

1

http://wiwirdo.ac.ug...

windows7-x64

10

http://wiwirdo.ac.ug...

windows10-2004-x64

10

Analysis

  • max time kernel
    107s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20220715-en
  • resource tags

    arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
  • submitted
    12-08-2022 05:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    http://wiwirdo.ac.ug/azne.exe

Score
10/10
azorultinfostealertrojan

Malware Config

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
    adwarespyware
  • Modifies registry class 48 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://wiwirdo.ac.ug/azne.exe
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1932
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1264
  • C:\Users\Admin\Desktop\azne.exe
    "C:\Users\Admin\Desktop\azne.exe"
    1⤵
    • Executes dropped EXE
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1824
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      2⤵
        PID:760

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    2
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\WPY7EY0I.txt
      Filesize

      605B

      MD5

      b8b9aa6a95901652abc10d4ab25d7e9f

      SHA1

      084edd1f923b6adbd75ef454b5747d0a92639e3c

      SHA256

      39275ca51d3708a3d3e56392492c08fe7761bcd87d81b47511df73faff4ab223

      SHA512

      10bb8ca84f34fe6e50075b9f519cdcbd7b628800b0b97dc84234dcf31da96256472eca3e9d10abfa4174aa2d81c65adcf25c52c914e194b9ef8e0ea2a6bb4d96

      Download Submit
    • C:\Users\Admin\Desktop\azne.exe
      Filesize

      283KB

      MD5

      438cbbc5449ace7dc2f23c8f884a51e5

      SHA1

      e485f4b2797c6e3cb66c0fdcf388a4373b5dc495

      SHA256

      c56d7650cb69a9ecc1cb26d4324a0708ae5eea20e640b33e32bbcb45b58c0703

      SHA512

      2c92aea2256975d7eaf2f0c35622a41dfd189961f4fc5f302ec6133cd6aa8e6ab80d089e594afa51fc71c3d7bff4737e8ebafbd7c2c6327d73cd1682f1b6afb2

      Download Submit
    • C:\Users\Admin\Desktop\azne.exe.owqk6ld.partial
      Filesize

      283KB

      MD5

      438cbbc5449ace7dc2f23c8f884a51e5

      SHA1

      e485f4b2797c6e3cb66c0fdcf388a4373b5dc495

      SHA256

      c56d7650cb69a9ecc1cb26d4324a0708ae5eea20e640b33e32bbcb45b58c0703

      SHA512

      2c92aea2256975d7eaf2f0c35622a41dfd189961f4fc5f302ec6133cd6aa8e6ab80d089e594afa51fc71c3d7bff4737e8ebafbd7c2c6327d73cd1682f1b6afb2

      Download Submit
    • memory/760-68-0x000000000041A684-mapping.dmp
      Download
    • memory/760-61-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

      Download
    • memory/760-60-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

      Download
    • memory/760-65-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

      Download
    • memory/760-64-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

      Download
    • memory/760-63-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

      Download
    • memory/760-67-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

      Download
    • memory/760-70-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

      Download
    • memory/760-72-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

      Download
    • memory/1824-58-0x0000000000CF0000-0x0000000000D48000-memory.dmp
      Filesize

      352KB

      Download
    • memory/1824-59-0x0000000000B40000-0x0000000000B8C000-memory.dmp
      Filesize

      304KB

      Download
    • memory/1824-57-0x0000000076281000-0x0000000076283000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1824-56-0x00000000013A0000-0x00000000013EC000-memory.dmp
      Filesize

      304KB

      Download