azorult | 722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088

Resubmissions

27/11/2022, 20:01

221127-yrz42aad2z 10

12/05/2022, 13:49

220512-q47ewafeb7 10

Analysis

max time kernel
191s
max time network
198s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe
Size

483KB
MD5

7a0093c743fc33a5e111f2fec269f79b
SHA1

feadb2ca02d41f2d834b8577f39a582d4bdd734f
SHA256

722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088
SHA512

77cade5a9e48f8d1da6e689a7881b23a1be165f1be8f26059458766e6fc4db8c03c058beb19dd0f644aebd218371ef487fe31a086e6fbc7089976d0802010eee
SSDEEP

12288:9ydPkF/ZAC8I1SkXHmjQ961/Tl9/EHDO2wb:U+F/ZA/8SkXx61LIHDO

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://5gw4d.xyz/PL341/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1956 set thread context of 1828	1956	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1784	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1412	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1412	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1412	1956	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	28
PID 1956 wrote to memory of 1412	1956	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	28
PID 1956 wrote to memory of 1412	1956	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	28
PID 1956 wrote to memory of 1412	1956	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	28
PID 1956 wrote to memory of 1784	1956	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	30
PID 1956 wrote to memory of 1784	1956	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	30
PID 1956 wrote to memory of 1784	1956	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	30
PID 1956 wrote to memory of 1784	1956	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	30
PID 1956 wrote to memory of 1828	1956	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	32
PID 1956 wrote to memory of 1828	1956	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	32
PID 1956 wrote to memory of 1828	1956	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	32
PID 1956 wrote to memory of 1828	1956	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	32
PID 1956 wrote to memory of 1828	1956	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	32
PID 1956 wrote to memory of 1828	1956	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	32
PID 1956 wrote to memory of 1828	1956	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	32
PID 1956 wrote to memory of 1828	1956	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	32
PID 1956 wrote to memory of 1828	1956	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	32
PID 1956 wrote to memory of 1828	1956	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	32

C:\Users\Admin\AppData\Local\Temp\722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe
"C:\Users\Admin\AppData\Local\Temp\722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VbxFiQYCyFDgGL.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1412
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VbxFiQYCyFDgGL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2A2D.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1784
- C:\Users\Admin\AppData\Local\Temp\722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe
  "C:\Users\Admin\AppData\Local\Temp\722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe"
  2⤵
  PID:1828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2A2D.tmp

Filesize
1KB

MD5
593a7cf25e070c5cdb11b205a6a3be7f

SHA1
6e927ecb2feb863a077764f0150949cf5c3e0d91

SHA256
3e89e4825fd067c833b71b38e5314d955f558d9ce3f7a1a2986a331eaf12cb3d

SHA512
82d9fa9f4734dc9205770e76c870ab15809917e2812bf2424bfa99d6287a5f46d74dd3f17e16ea78efaa252c43d91d0a0757fcdbddfc8e7ed2ce28c42d4f40c4

Download Submit
memory/1412-78-0x000000006E560000-0x000000006EB0B000-memory.dmp

Filesize
5.7MB

Download
memory/1412-76-0x000000006E560000-0x000000006EB0B000-memory.dmp

Filesize
5.7MB

Download
memory/1828-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1828-69-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1828-79-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1828-77-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1828-64-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1828-74-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1828-67-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1828-68-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1828-71-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1956-58-0x0000000005D00000-0x0000000005D66000-memory.dmp

Filesize
408KB

Download
memory/1956-54-0x0000000000240000-0x00000000002C0000-memory.dmp

Filesize
512KB

Download
memory/1956-56-0x0000000005C20000-0x0000000005C8C000-memory.dmp

Filesize
432KB

Download
memory/1956-63-0x0000000004760000-0x0000000004782000-memory.dmp

Filesize
136KB

Download
memory/1956-55-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download
memory/1956-57-0x0000000001EB0000-0x0000000001EC8000-memory.dmp

Filesize
96KB

Download