azorult | b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03

Analysis

max time kernel
139s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 06:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
Size

510KB
MD5

1567c21815e4106a3fac9b2cef843e05
SHA1

14f49f9c6978333b628f58f88de01bbd936b1952
SHA256

b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03
SHA512

f6b5ac901ed1b275f4233b8a1ad46f694654a3a3a640fcbd91c167bcebd64fc77b103dbff8b262f9cf180206fdbf2de11928a3c673f58031cd26d54955f780e1
SSDEEP

6144:1z2yP2JhecVucqmbafvj4Dlq7YR3N+tnXsUrk2fUJaZqicB3oxLJfW4uMuuei9QT:Yh9I+aXOlq7GN+QvJExLj0UQPL

Score

10^/10

azorult infostealer trojan

Malware Config

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe

Loads dropped DLL 16 IoCs

pid	Process
4412	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
4412	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
4412	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
4412	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
4412	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
4412	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
4412	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
4412	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
4412	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
4412	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
4412	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
4412	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
4412	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
4412	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
4412	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
4412	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4984	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4412	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
4984	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4412 set thread context of 4984	4412	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe	93

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\armstolenes.Sno	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\Sandboxes59\vismuts.ini	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
File opened for modification	C:\Windows\resources\0409\digitalurenes.tra	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
File opened for modification	C:\Windows\resources\Transited106.Hor	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4412	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 4984	4412	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe	93
PID 4412 wrote to memory of 4984	4412	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe	93
PID 4412 wrote to memory of 4984	4412	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe	93
PID 4412 wrote to memory of 4984	4412	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe	93
PID 4412 wrote to memory of 4984	4412	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe	93

C:\Users\Admin\AppData\Local\Temp\b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
"C:\Users\Admin\AppData\Local\Temp\b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Users\Admin\AppData\Local\Temp\b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe"
  2⤵
  - Checks QEMU agent file
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nseF7BF.tmp\BgImage.dll

Filesize
7KB

MD5
350a507070ed063ac6a511aeef67861a

SHA1
cf647b90a1212e090f1d236d1b50a5010cbf3bae

SHA256
5c66abd3f06eaa357ed9663224c927cf7120dca010572103faa88832bb31c5ab

SHA512
cde5747cc8539625e4262afad9699ce4e8325133d7ed7f47b9d46989a7aa0d2cc2488441acc57368f485ef1dd3e02b9ef2faa642f68e9f1db53a39e0f896d468

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseF7BF.tmp\BgImage.dll

Filesize
7KB

MD5
350a507070ed063ac6a511aeef67861a

SHA1
cf647b90a1212e090f1d236d1b50a5010cbf3bae

SHA256
5c66abd3f06eaa357ed9663224c927cf7120dca010572103faa88832bb31c5ab

SHA512
cde5747cc8539625e4262afad9699ce4e8325133d7ed7f47b9d46989a7aa0d2cc2488441acc57368f485ef1dd3e02b9ef2faa642f68e9f1db53a39e0f896d468

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseF7BF.tmp\BgImage.dll

Filesize
7KB

MD5
350a507070ed063ac6a511aeef67861a

SHA1
cf647b90a1212e090f1d236d1b50a5010cbf3bae

SHA256
5c66abd3f06eaa357ed9663224c927cf7120dca010572103faa88832bb31c5ab

SHA512
cde5747cc8539625e4262afad9699ce4e8325133d7ed7f47b9d46989a7aa0d2cc2488441acc57368f485ef1dd3e02b9ef2faa642f68e9f1db53a39e0f896d468

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseF7BF.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseF7BF.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseF7BF.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseF7BF.tmp\nsDialogs.dll

Filesize
9KB

MD5
13b6a88cf284d0f45619e76191e2b995

SHA1
09ebb0eb4b1dca73d354368414906fc5ad667e06

SHA256
cb958e21c3935ef7697a2f14d64cae0f9264c91a92d2deeb821ba58852dac911

SHA512
2aeeae709d759e34592d8a06c90e58aa747e14d54be95fb133994fdcebb1bdc8bc5d82782d0c8c3cdfd35c7bea5d7105379d3c3a25377a8c958c7b2555b1209e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseF7BF.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseF7BF.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseF7BF.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseF7BF.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseF7BF.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseF7BF.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseF7BF.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseF7BF.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseF7BF.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseF7BF.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseF7BF.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseF7BF.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
memory/4412-53-0x0000000077771000-0x0000000077891000-memory.dmp

Filesize
1.1MB

Download
memory/4412-54-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/4984-55-0x00000000777F8000-0x00000000777F9000-memory.dmp

Filesize
4KB

Download
memory/4984-56-0x0000000077815000-0x0000000077816000-memory.dmp

Filesize
4KB

Download
memory/4984-63-0x00000000730E0000-0x0000000074334000-memory.dmp

Filesize
18.3MB

Download
memory/4984-64-0x0000000000450000-0x0000000004DA7000-memory.dmp

Filesize
73.3MB

Download
memory/4984-66-0x0000000000060000-0x0000000000087000-memory.dmp

Filesize
156KB

Download
memory/4984-67-0x0000000000450000-0x0000000004DA7000-memory.dmp

Filesize
73.3MB

Download
memory/4984-68-0x00000000730E0000-0x0000000074334000-memory.dmp

Filesize
18.3MB

Download
memory/4984-69-0x0000000077771000-0x0000000077891000-memory.dmp

Filesize
1.1MB

Download