azorult | 722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088

Resubmissions

27-11-2022 20:01

221127-yrz42aad2z 10

12-05-2022 13:49

220512-q47ewafeb7 10

Analysis

max time kernel
206s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe
Size

483KB
MD5

7a0093c743fc33a5e111f2fec269f79b
SHA1

feadb2ca02d41f2d834b8577f39a582d4bdd734f
SHA256

722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088
SHA512

77cade5a9e48f8d1da6e689a7881b23a1be165f1be8f26059458766e6fc4db8c03c058beb19dd0f644aebd218371ef487fe31a086e6fbc7089976d0802010eee
SSDEEP

12288:9ydPkF/ZAC8I1SkXHmjQ961/Tl9/EHDO2wb:U+F/ZA/8SkXx61LIHDO

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://5gw4d.xyz/PL341/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1108 set thread context of 3464	1108	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4456	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
928	powershell.exe
928	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	928	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 928	1108	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	91
PID 1108 wrote to memory of 928	1108	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	91
PID 1108 wrote to memory of 928	1108	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	91
PID 1108 wrote to memory of 4456	1108	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	93
PID 1108 wrote to memory of 4456	1108	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	93
PID 1108 wrote to memory of 4456	1108	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	93
PID 1108 wrote to memory of 3464	1108	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	95
PID 1108 wrote to memory of 3464	1108	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	95
PID 1108 wrote to memory of 3464	1108	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	95
PID 1108 wrote to memory of 3464	1108	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	95
PID 1108 wrote to memory of 3464	1108	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	95
PID 1108 wrote to memory of 3464	1108	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	95
PID 1108 wrote to memory of 3464	1108	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	95
PID 1108 wrote to memory of 3464	1108	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	95
PID 1108 wrote to memory of 3464	1108	722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe	95

C:\Users\Admin\AppData\Local\Temp\722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe
"C:\Users\Admin\AppData\Local\Temp\722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VbxFiQYCyFDgGL.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:928
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VbxFiQYCyFDgGL" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCFED.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4456
- C:\Users\Admin\AppData\Local\Temp\722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe
  "C:\Users\Admin\AppData\Local\Temp\722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088.exe"
  2⤵
  PID:3464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpCFED.tmp

Filesize
1KB

MD5
15e7c8e402ee68696d6a5f0c150938c9

SHA1
ce412948347b1bfef2593d68f528327dda369781

SHA256
975a77d6a5b5315169c8c056cee2f9af2c10df406e883c7af652eb189079f779

SHA512
c68e91857fbf12218b2998500065623a244bc10db06462d6f714e734d0deaa3e8291c8ccc98a7c282ad60f623b2e6d55c8201d66d101fbde27e90e658cf58193

Download Submit
memory/928-140-0x0000000002CA0000-0x0000000002CD6000-memory.dmp

Filesize
216KB

Download
memory/928-151-0x0000000006460000-0x000000000647E000-memory.dmp

Filesize
120KB

Download
memory/928-149-0x0000000005E50000-0x0000000005EB6000-memory.dmp

Filesize
408KB

Download
memory/928-148-0x00000000055F0000-0x0000000005612000-memory.dmp

Filesize
136KB

Download
memory/928-141-0x00000000057B0000-0x0000000005DD8000-memory.dmp

Filesize
6.2MB

Download
memory/928-138-0x0000000000000000-mapping.dmp

Download
memory/1108-136-0x00000000071B0000-0x000000000724C000-memory.dmp

Filesize
624KB

Download
memory/1108-137-0x00000000074F0000-0x0000000007556000-memory.dmp

Filesize
408KB

Download
memory/1108-132-0x0000000000320000-0x00000000003A0000-memory.dmp

Filesize
512KB

Download
memory/1108-135-0x0000000004D50000-0x0000000004D5A000-memory.dmp

Filesize
40KB

Download
memory/1108-134-0x0000000004D60000-0x0000000004DF2000-memory.dmp

Filesize
584KB

Download
memory/1108-133-0x0000000005460000-0x0000000005A04000-memory.dmp

Filesize
5.6MB

Download
memory/3464-143-0x0000000000000000-mapping.dmp

Download
memory/3464-144-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3464-146-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3464-147-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3464-150-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4456-139-0x0000000000000000-mapping.dmp

Download