azorult | 08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7

Analysis

max time kernel
155s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7.exe
Size

1.3MB
MD5

a254a999da1c53a910f400cc665c8b57
SHA1

94ecb7ab060a9080ec98730ee188309e484f56c0
SHA256

08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7
SHA512

525f40a783b7fdc6a4d194abc556855b4cadc084dc07035eaa10bce960aa2d91c4fa5e7bf8c8662742f38382605c851f4cbb4b64b07752c95164add235def01e
SSDEEP

24576:Qu6J33O0c+JY5UZ+XC0kGso6FauiKDhTUJMeU6UW7srJAHrrfWY:au0c++OCvkGs9Faulv6UfAHryY

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://179.43.156.19/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Blocklisted process makes network request 3 IoCs

Processes:

WScript.exe

flow pid process

12 4968 WScript.exe
13 4968 WScript.exe
16 4968 WScript.exe

flow	pid	process
12	4968	WScript.exe
13	4968	WScript.exe
16	4968	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

Processes:

08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7.exe

description	pid	process	target process
PID 2748 set thread context of 3440	2748	08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7.exe	08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7.exe

description	pid	process	target process
PID 2748 wrote to memory of 4968	2748	08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7.exe	WScript.exe
PID 2748 wrote to memory of 4968	2748	08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7.exe	WScript.exe
PID 2748 wrote to memory of 4968	2748	08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7.exe	WScript.exe
PID 2748 wrote to memory of 3440	2748	08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7.exe	08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7.exe
PID 2748 wrote to memory of 3440	2748	08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7.exe	08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7.exe
PID 2748 wrote to memory of 3440	2748	08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7.exe	08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7.exe
PID 2748 wrote to memory of 3440	2748	08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7.exe	08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7.exe
PID 2748 wrote to memory of 3440	2748	08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7.exe	08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7.exe

C:\Users\Admin\AppData\Local\Temp\08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7.exe
"C:\Users\Admin\AppData\Local\Temp\08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2748

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ipras_cleartypeswitch6.vbs"
2⤵
- Blocklisted process makes network request
PID:4968

C:\Users\Admin\AppData\Local\Temp\08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7.exe
"C:\Users\Admin\AppData\Local\Temp\08fec58b8798ebd18c6a78bda2774806e3a40001fc19a2811d5c780933cf12d7.exe"
2⤵
PID:3440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ipras_cleartypeswitch6.vbs

Filesize
2KB

MD5
5f0edb81e5d2c8916a1181a768e8ca6c

SHA1
f750380e9f169abeb6a34325dd4f47911e49bdad

SHA256
35c8c534f04fc22fc98783fb01198c1a9b11f5f6628e815901794740d150c7b2

SHA512
ecb9621237e1ad91f0242df59dba2bcf2cbd6a451de685c2be3d5c2eab4e4234afc6e1998e04f90566fb09fa92033404b4b9801e04e8b67b993877d78e169829

Download Submit
memory/3440-134-0x0000000000000000-mapping.dmp

Download
memory/3440-135-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3440-143-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4968-132-0x0000000000000000-mapping.dmp

Download