azorult | c1ffbd89a550c5c4f03d5a595efca82943336d0fd2b6b7592252d7cc18389628

Analysis

max time kernel
60s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2022 07:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17b07c4b4f7bf58c0eaf82eda4194ef1.exe
Size

648KB
MD5

17b07c4b4f7bf58c0eaf82eda4194ef1
SHA1

f4394c1aa83a446829de15d519899962cdaf3e68
SHA256

c1ffbd89a550c5c4f03d5a595efca82943336d0fd2b6b7592252d7cc18389628
SHA512

0eae75405a4c4c0ceaa1947b9e66c86d50c3e86ce27b20c44abffdd182303a0afea7c595baea09aee41cd4028bf77892fc3ba9b08d22519129aa0c194109a328

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://195.245.112.115/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

17b07c4b4f7bf58c0eaf82eda4194ef1.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	17b07c4b4f7bf58c0eaf82eda4194ef1.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

17b07c4b4f7bf58c0eaf82eda4194ef1.exe

description pid process target process

PID 4716 set thread context of 1152 4716 17b07c4b4f7bf58c0eaf82eda4194ef1.exe InstallUtil.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

17b07c4b4f7bf58c0eaf82eda4194ef1.exe

pid process

4716 17b07c4b4f7bf58c0eaf82eda4194ef1.exe
4716 17b07c4b4f7bf58c0eaf82eda4194ef1.exe

description	pid	process	target process
PID 4716 set thread context of 1152	4716	17b07c4b4f7bf58c0eaf82eda4194ef1.exe	InstallUtil.exe

pid	process
4716	17b07c4b4f7bf58c0eaf82eda4194ef1.exe
4716	17b07c4b4f7bf58c0eaf82eda4194ef1.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

17b07c4b4f7bf58c0eaf82eda4194ef1.exe

description	pid	process	target process
PID 4716 wrote to memory of 1152	4716	17b07c4b4f7bf58c0eaf82eda4194ef1.exe	InstallUtil.exe
PID 4716 wrote to memory of 1152	4716	17b07c4b4f7bf58c0eaf82eda4194ef1.exe	InstallUtil.exe
PID 4716 wrote to memory of 1152	4716	17b07c4b4f7bf58c0eaf82eda4194ef1.exe	InstallUtil.exe
PID 4716 wrote to memory of 1152	4716	17b07c4b4f7bf58c0eaf82eda4194ef1.exe	InstallUtil.exe
PID 4716 wrote to memory of 1152	4716	17b07c4b4f7bf58c0eaf82eda4194ef1.exe	InstallUtil.exe
PID 4716 wrote to memory of 1152	4716	17b07c4b4f7bf58c0eaf82eda4194ef1.exe	InstallUtil.exe
PID 4716 wrote to memory of 1152	4716	17b07c4b4f7bf58c0eaf82eda4194ef1.exe	InstallUtil.exe
PID 4716 wrote to memory of 1152	4716	17b07c4b4f7bf58c0eaf82eda4194ef1.exe	InstallUtil.exe
PID 4716 wrote to memory of 1152	4716	17b07c4b4f7bf58c0eaf82eda4194ef1.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\17b07c4b4f7bf58c0eaf82eda4194ef1.exe
"C:\Users\Admin\AppData\Local\Temp\17b07c4b4f7bf58c0eaf82eda4194ef1.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4716

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
2⤵
PID:1152

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1152-134-0x0000000000000000-mapping.dmp

Download
memory/1152-135-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1152-137-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1152-138-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4716-132-0x0000000000F00000-0x0000000000FA8000-memory.dmp

Filesize
672KB

Download
memory/4716-133-0x0000000005890000-0x00000000058B2000-memory.dmp

Filesize
136KB

Download