azorult | 6486f5be9f0ff36a4ee989e0f9e21c9e3dcfcf0875588aaf0e0b3645a9e7d013

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2023 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da4639c1d3d19efcbf6518e934d560a94e10cfee4f2d87d2d3bab033258f9de2.exe
Size

1.4MB
MD5

e95513699fc482656195fbde55356a3e
SHA1

0fe81c9795cf8f69900282d0f221d7bdcc6c7dc0
SHA256

da4639c1d3d19efcbf6518e934d560a94e10cfee4f2d87d2d3bab033258f9de2
SHA512

be1918721fe9c55c3d021a541c125e5732f63e6668df0551c9472523ee4ddc6c70b34d588511e84bca75715645b8c143dbe394901f22f1c3f8715e3a3f3aae17
SSDEEP

6144:e71cs+BmGGNzFb8JVQzB6fx2CxwXL/O8VNkNXfY1MTrFWLrUxoooooooooooG6d3:eRcczFbUVQzUYO8VNkV5TrFed

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://193.42.33.252/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

Processes:

da4639c1d3d19efcbf6518e934d560a94e10cfee4f2d87d2d3bab033258f9de2.exe

description	pid	process	target process
PID 2364 set thread context of 2224	2364	da4639c1d3d19efcbf6518e934d560a94e10cfee4f2d87d2d3bab033258f9de2.exe	vbc.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4416 2224 WerFault.exe vbc.exe

pid	pid_target	process	target process
4416	2224	WerFault.exe	vbc.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

da4639c1d3d19efcbf6518e934d560a94e10cfee4f2d87d2d3bab033258f9de2.exe

description	pid	process	target process
PID 2364 wrote to memory of 2224	2364	da4639c1d3d19efcbf6518e934d560a94e10cfee4f2d87d2d3bab033258f9de2.exe	vbc.exe
PID 2364 wrote to memory of 2224	2364	da4639c1d3d19efcbf6518e934d560a94e10cfee4f2d87d2d3bab033258f9de2.exe	vbc.exe
PID 2364 wrote to memory of 2224	2364	da4639c1d3d19efcbf6518e934d560a94e10cfee4f2d87d2d3bab033258f9de2.exe	vbc.exe
PID 2364 wrote to memory of 2224	2364	da4639c1d3d19efcbf6518e934d560a94e10cfee4f2d87d2d3bab033258f9de2.exe	vbc.exe
PID 2364 wrote to memory of 2224	2364	da4639c1d3d19efcbf6518e934d560a94e10cfee4f2d87d2d3bab033258f9de2.exe	vbc.exe
PID 2364 wrote to memory of 2224	2364	da4639c1d3d19efcbf6518e934d560a94e10cfee4f2d87d2d3bab033258f9de2.exe	vbc.exe
PID 2364 wrote to memory of 2224	2364	da4639c1d3d19efcbf6518e934d560a94e10cfee4f2d87d2d3bab033258f9de2.exe	vbc.exe
PID 2364 wrote to memory of 2224	2364	da4639c1d3d19efcbf6518e934d560a94e10cfee4f2d87d2d3bab033258f9de2.exe	vbc.exe
PID 2364 wrote to memory of 2224	2364	da4639c1d3d19efcbf6518e934d560a94e10cfee4f2d87d2d3bab033258f9de2.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\da4639c1d3d19efcbf6518e934d560a94e10cfee4f2d87d2d3bab033258f9de2.exe
"C:\Users\Admin\AppData\Local\Temp\da4639c1d3d19efcbf6518e934d560a94e10cfee4f2d87d2d3bab033258f9de2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2364

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 360
3⤵
- Program crash
PID:4416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2224 -ip 2224
1⤵
PID:692

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2224-135-0x0000000000F00000-0x0000000000F20000-memory.dmp

Filesize
128KB

Download
memory/2224-137-0x0000000000F00000-0x0000000000F20000-memory.dmp

Filesize
128KB

Download
memory/2224-142-0x0000000000F00000-0x0000000000F20000-memory.dmp

Filesize
128KB

Download
memory/2364-133-0x00000000009F0000-0x0000000000B5E000-memory.dmp

Filesize
1.4MB

Download
memory/2364-134-0x0000000005580000-0x00000000055E6000-memory.dmp

Filesize
408KB

Download
memory/2364-140-0x0000000005680000-0x0000000005690000-memory.dmp

Filesize
64KB

Download
memory/2364-143-0x0000000005680000-0x0000000005690000-memory.dmp

Filesize
64KB

Download