azorult | 0039d540adf84e057f21e1fe1373089299824e91b57f978e260898ae600ad9e0

Analysis

max time kernel
134s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2023 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe
Size

949KB
MD5

177be2c914b334bb9ae441b179c47ad3
SHA1

ec3e5b9988da762df5797e6ba7e37321aaedc142
SHA256

37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452
SHA512

cf3f23cca7ec032b84253436a7a49668e3319aa1fd5628749819d20b72c973627b61522b25ec36e511bb66387ba2723c5ac0f0ab3251ff515334c4ccf097f94c
SSDEEP

12288:HEX3jBVmNUfqBe4G/+69C9quC8s08jHJNXhInMvHE3iYusAf+1SWv5fs:+tYNUfqBpOc5CnpNx+MvH7YpH1SWvB

Score

10^/10

azorult collection discovery infostealer spyware stealer trojan

Malware Config

Extracted

Family

azorult

http://171.22.30.164/standright/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Loads dropped DLL 4 IoCs

Processes:

37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe

pid	process
1200	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe
1200	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe
1200	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe
1200	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe
Key opened	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe
Key opened	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{D32DD1BE-6399-4DE6-874F-72EF908EEF61}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{F15EBBFF-84B5-4EE4-A766-B372217B4499}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NXQXXLFST89.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NXQXXLFST89.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe

description	pid	process	target process
PID 3148 set thread context of 1200	3148	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe

pid	process
1200	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe
1200	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe

description	pid	process	target process
PID 3148 wrote to memory of 1200	3148	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe
PID 3148 wrote to memory of 1200	3148	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe
PID 3148 wrote to memory of 1200	3148	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe
PID 3148 wrote to memory of 1200	3148	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe
PID 3148 wrote to memory of 1200	3148	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe
PID 3148 wrote to memory of 1200	3148	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe
PID 3148 wrote to memory of 1200	3148	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe
PID 3148 wrote to memory of 1200	3148	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe
PID 3148 wrote to memory of 1200	3148	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

Processes:

37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe

outlook_win_path 1 IoCs

Processes:

37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe

C:\Users\Admin\AppData\Local\Temp\37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe
"C:\Users\Admin\AppData\Local\Temp\37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3148

C:\Users\Admin\AppData\Local\Temp\37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe
"C:\Users\Admin\AppData\Local\Temp\37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452.exe"
2⤵
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:1200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:3892

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\B2503312\mozglue.dll
Filesize
135KB

MD5
9e682f1eb98a9d41468fc3e50f907635

SHA1
85e0ceca36f657ddf6547aa0744f0855a27527ee

SHA256
830533bb569594ec2f7c07896b90225006b90a9af108f49d6fb6bebd02428b2d

SHA512
230230722d61ac1089fabf3f2decfa04f9296498f8e2a2a49b1527797dca67b5a11ab8656f04087acadf873fa8976400d57c77c404eba4aff89d92b9986f32ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\B2503312\msvcp140.dll
Filesize
429KB

MD5
109f0f02fd37c84bfc7508d4227d7ed5

SHA1
ef7420141bb15ac334d3964082361a460bfdb975

SHA256
334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

SHA512
46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

Download Submit
C:\Users\Admin\AppData\Local\Temp\B2503312\nss3.dll
Filesize
1.2MB

MD5
556ea09421a0f74d31c4c0a89a70dc23

SHA1
f739ba9b548ee64b13eb434a3130406d23f836e3

SHA256
f0e6210d4a0d48c7908d8d1c270449c91eb4523e312a61256833bfeaf699abfb

SHA512
2481fc80dffa8922569552c3c3ebaef8d0341b80427447a14b291ec39ea62ab9c05a75e85eef5ea7f857488cab1463c18586f9b076e2958c5a314e459045ede2

Download Submit
C:\Users\Admin\AppData\Local\Temp\B2503312\vcruntime140.dll
Filesize
81KB

MD5
7587bf9cb4147022cd5681b015183046

SHA1
f2106306a8f6f0da5afb7fc765cfa0757ad5a628

SHA256
c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

SHA512
0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsu6B7B.tmp
Filesize
36KB

MD5
761388ca8095173f6963b1d23ad8a68b

SHA1
41e2693d0efc36cb0b97ea215d554932c46464ab

SHA256
369a2323cb569b44970884d5af3d70e38c9cfb59a54d929fabb51ba46593aa06

SHA512
2db4576927b4325dc51ce1755d55b00f7153a10424ca79fb7f32f8c92a5dec899c3961b44a15a129f1e5234b53a89c8946192703b88b10e70e86670e5831ebdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsuC0E3.tmp
Filesize
14KB

MD5
c01eaa0bdcd7c30a42bbb35a9acbf574

SHA1
0aee3e1b873e41d040f1991819d0027b6cc68f54

SHA256
32297224427103aa1834dba276bf5d49cd5dd6bda0291422e47ad0d0706c6d40

SHA512
d26ff775ad39425933cd3df92209faa53ec5b701e65bfbcccc64ce8dd3e79f619a9bad7cc975a98a95f2006ae89e50551877fc315a3050e48d5ab89e0802e2b7

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat
Filesize
29KB

MD5
16f1adbb7d589cd48ac79ce124abb670

SHA1
f9d876c26786f0f2299ad7eba5f84ba4f90e9be1

SHA256
6cf5bb35e1a7c4bd27a215702c3e22e580500d5e049436f537a7202130eb7a12

SHA512
aae568338576c01711f8fde4583a7f6566add8110f7967a793b435f51e86efbde9d7496bed804609bbbfe8461d87fbfc0d530dfe02ee074522fcb01555def8b2

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NXQXXLFST89.dat
Filesize
66KB

MD5
1779cdebfd22e784c887836951433fc2

SHA1
7c876fb686a98d48897d209f9a44424891f09c44

SHA256
b6357779e53d1f21bab9dc4282a0d3f51267704bc1698dc7df230891c21910a5

SHA512
ca0b95f32ffbb443b92d1c005aa02e702cef4214431c084b8448fd0d90adefaee3c1e0922347f8e740dce6ab621442f46cfd3e5fdf76165f2c84c69706b47004

Download Submit
memory/1200-145-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1200-146-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1200-142-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1200-279-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3148-133-0x0000000000AB0000-0x0000000000BA4000-memory.dmp

Filesize
976KB

Download
memory/3148-141-0x0000000008510000-0x00000000085AC000-memory.dmp

Filesize
624KB

Download
memory/3148-140-0x0000000005960000-0x0000000005970000-memory.dmp

Filesize
64KB

Download
memory/3148-137-0x0000000005960000-0x0000000005970000-memory.dmp

Filesize
64KB

Download
memory/3148-136-0x0000000003110000-0x000000000311A000-memory.dmp

Filesize
40KB

Download
memory/3148-135-0x0000000005590000-0x0000000005622000-memory.dmp

Filesize
584KB

Download
memory/3148-134-0x0000000005D20000-0x00000000062C4000-memory.dmp

Filesize
5.6MB

Download