azorult | 6471f1c24df8a904cc1082929f46c4acfd9ce5e93128b74e50968b627580ea81

Analysis

max time kernel
140s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
15/08/2023, 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6471f1c24df8a904cc1082929f46c4acfd9ce5e93128b74e50968b627580ea81_JC.exe
Size

197KB
MD5

550dd68e9716d6e149608db46e72ed4c
SHA1

111772b5f2fff7502a4bde6a2128ea114e1a0101
SHA256

6471f1c24df8a904cc1082929f46c4acfd9ce5e93128b74e50968b627580ea81
SHA512

88f7ec77f83b07c7e384de046e5f4b50f88fafddb59c110c37a636f50cec394ee7985e9957466f0eaf741dde8aa49417df62c594123db90eda96dafde71412fb
SSDEEP

3072:3fY/TU9fE9PEtuUbJhhSWLC7tFWn2ZvKtQBDrXYYWd4RibzNrwlpC46J/RTluV0n:vYa6A/hSLG+KtQxhW7bzGCXJ/RTlBwpY

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://csbo1.shop/MSB01/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Loads dropped DLL 1 IoCs

pid	Process
1548	6471f1c24df8a904cc1082929f46c4acfd9ce5e93128b74e50968b627580ea81_JC.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1548 set thread context of 644	1548	6471f1c24df8a904cc1082929f46c4acfd9ce5e93128b74e50968b627580ea81_JC.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1548	6471f1c24df8a904cc1082929f46c4acfd9ce5e93128b74e50968b627580ea81_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 644	1548	6471f1c24df8a904cc1082929f46c4acfd9ce5e93128b74e50968b627580ea81_JC.exe	81
PID 1548 wrote to memory of 644	1548	6471f1c24df8a904cc1082929f46c4acfd9ce5e93128b74e50968b627580ea81_JC.exe	81
PID 1548 wrote to memory of 644	1548	6471f1c24df8a904cc1082929f46c4acfd9ce5e93128b74e50968b627580ea81_JC.exe	81
PID 1548 wrote to memory of 644	1548	6471f1c24df8a904cc1082929f46c4acfd9ce5e93128b74e50968b627580ea81_JC.exe	81

C:\Users\Admin\AppData\Local\Temp\6471f1c24df8a904cc1082929f46c4acfd9ce5e93128b74e50968b627580ea81_JC.exe
"C:\Users\Admin\AppData\Local\Temp\6471f1c24df8a904cc1082929f46c4acfd9ce5e93128b74e50968b627580ea81_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Users\Admin\AppData\Local\Temp\6471f1c24df8a904cc1082929f46c4acfd9ce5e93128b74e50968b627580ea81_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\6471f1c24df8a904cc1082929f46c4acfd9ce5e93128b74e50968b627580ea81_JC.exe"
  2⤵
  PID:644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsuDEE8.tmp\mpylfnmz.dll

Filesize
89KB

MD5
8668f9c2351ca615d305ce897b1b0de9

SHA1
700ac257389189498b8e753eeee1123e44443188

SHA256
54ad39b23ec8af5663fc01b0c19ffd03cff8f92e9865944828135da4bfa0746c

SHA512
9e489065455564fc9af0f678a13712de377c1ec4c1a3c6313aa4c504b179c57057a70f00e8b3e376d3e0297bee87dc1c019a5b6683cf11369208f09eef2c09ce

Download Submit
memory/644-140-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/644-142-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/644-143-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/644-144-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1548-139-0x00000000032A0000-0x00000000032A2000-memory.dmp

Filesize
8KB

Download