azorult | a7f8ea157b43f41eee62a257ff09d62745fc2951b7fd80edc223b30e4bf5432c

Analysis

max time kernel
165s
max time network
182s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
18/05/2023, 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6165ccf33902415f411c981a6ce740bc.exe
Size

354KB
MD5

6165ccf33902415f411c981a6ce740bc
SHA1

45b2bb7295ed87c63fa32d040a3fcb58c9451c1c
SHA256

a7f8ea157b43f41eee62a257ff09d62745fc2951b7fd80edc223b30e4bf5432c
SHA512

769e8a10a2c76fffa8c4d9f9c683c55545e552e12d72da8d6d0f2c1873ea560ea6d5e9dfc6dea63abcf4838c99f0d43ddb31d6ba3feb1f03f3a07d8b4d35703e
SSDEEP

6144:h4SUjhtXAPCRVb0DLj5VpQzmNGxzED+c5H9ByjuGHK2Tb+w/dd4OK/FtbSJPB7A/:6XAPCDgjhQqyzED+c5HHyjO2nHld4dFj

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://gkonekt.shop/PL341/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	6165ccf33902415f411c981a6ce740bc.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	6165ccf33902415f411c981a6ce740bc.exe

Loads dropped DLL 1 IoCs

pid	Process
932	6165ccf33902415f411c981a6ce740bc.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1872	6165ccf33902415f411c981a6ce740bc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
932	6165ccf33902415f411c981a6ce740bc.exe
1872	6165ccf33902415f411c981a6ce740bc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 932 set thread context of 1872	932	6165ccf33902415f411c981a6ce740bc.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
932	6165ccf33902415f411c981a6ce740bc.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 1872	932	6165ccf33902415f411c981a6ce740bc.exe	28
PID 932 wrote to memory of 1872	932	6165ccf33902415f411c981a6ce740bc.exe	28
PID 932 wrote to memory of 1872	932	6165ccf33902415f411c981a6ce740bc.exe	28
PID 932 wrote to memory of 1872	932	6165ccf33902415f411c981a6ce740bc.exe	28
PID 932 wrote to memory of 1872	932	6165ccf33902415f411c981a6ce740bc.exe	28

C:\Users\Admin\AppData\Local\Temp\6165ccf33902415f411c981a6ce740bc.exe
"C:\Users\Admin\AppData\Local\Temp\6165ccf33902415f411c981a6ce740bc.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:932
- C:\Users\Admin\AppData\Local\Temp\6165ccf33902415f411c981a6ce740bc.exe
  "C:\Users\Admin\AppData\Local\Temp\6165ccf33902415f411c981a6ce740bc.exe"
  2⤵
  - Checks QEMU agent file
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nseA363.tmp\System.dll

Filesize
11KB

MD5
a436db0c473a087eb61ff5c53c34ba27

SHA1
65ea67e424e75f5065132b539c8b2eda88aa0506

SHA256
75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

SHA512
908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

Download Submit
memory/1872-65-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1872-66-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1872-70-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1872-71-0x0000000001470000-0x000000000689D000-memory.dmp

Filesize
84.2MB

Download
memory/1872-72-0x0000000001470000-0x000000000689D000-memory.dmp

Filesize
84.2MB

Download
memory/1872-73-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download