azorult | 72465f74a5ef3b19cb51be862a02003bc406517bca79d5e4457223f95ee044b7

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FA010711pdf.exe
Size 388KB
Sample231014-bf4azsha31
SHA256 72465f74a5ef3b19cb51be862a02003bc406517bca79d5e4457223f95ee044b7
MD5 2cff60ccfe9bf21d3f98f749a278ac62
SHA1 e1e72717b047f2a9e08f208aa85f485c2115c89b
SHA512 3db72f01e8e7a5a222c63c03bb14b9dd1baafbcde3dc24b03f7e4c631c4b14939df8172541d11e8e293be15cc314e87aaabc6c862790f7357f3a03930d79647f
SSDEEP 6144:yYa6lMX3IjdMIQ5VcgYydjYku7NhM9bYqkazC:yYzPJMIQ5Vzm7zMtbzC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://46.183.220.70/bag/Panel/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Executes dropped EXE 2 IoCs

pid	Process
4468	wnvqhwx.exe
3608	wnvqhwx.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4468 set thread context of 3608	4468	wnvqhwx.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4468	wnvqhwx.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 4468	2292	FA010711pdf.exe	89
PID 2292 wrote to memory of 4468	2292	FA010711pdf.exe	89
PID 2292 wrote to memory of 4468	2292	FA010711pdf.exe	89
PID 4468 wrote to memory of 3608	4468	wnvqhwx.exe	90
PID 4468 wrote to memory of 3608	4468	wnvqhwx.exe	90
PID 4468 wrote to memory of 3608	4468	wnvqhwx.exe	90
PID 4468 wrote to memory of 3608	4468	wnvqhwx.exe	90

C:\Users\Admin\AppData\Local\Temp\FA010711pdf.exe
"C:\Users\Admin\AppData\Local\Temp\FA010711pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\AppData\Local\Temp\wnvqhwx.exe
  "C:\Users\Admin\AppData\Local\Temp\wnvqhwx.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Users\Admin\AppData\Local\Temp\wnvqhwx.exe
    "C:\Users\Admin\AppData\Local\Temp\wnvqhwx.exe"
    3⤵
    - Executes dropped EXE
    PID:3608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

oflyqnxj.mww

Path C:\Users\Admin\AppData\Local\Temp\oflyqnxj.mww
Size 132KB
SHA256 3f88a6738ad2e93942043d87fed1d72c4b7279fe40508f19a7df25bcf628e7db
MD5 c8ca0d52e4a2ff412cb67bcf9de73bad
SHA1 b9f0253197087dfee37b2f8ff69bd793cdbe19da
SHA512 b3b50062a2fb741c24218fe167b7c1ffbf6ea3729b909aeca7d25987f21baa3ec6bf179029bb7ba1ebd0a1af19d66e21976aee2d5b7e1abb4177236159e3593e
SSDEEP 3072:s1/+V+Mvfp3JxW5BoyGVAtIJPFEacuWXm5/lxrKFiDBTOSfe2:s1/2zp3OYyPOJ+luOolx+0iS1
MD5 SHA1 SHA512 SSDEEP

Submit Download

wnvqhwx.exe

Path C:\Users\Admin\AppData\Local\Temp\wnvqhwx.exe
Size 165KB
SHA256 daf2ab042ff533f2053f03abbaf2a6461490a4048979ae131b8a9716bf51e142
MD5 756c50b6fb4ef9ed3a9aabaae2ef9ea1
SHA1 e8e9b199c81d6e1e104b4a023970c904fb01a68a
SHA512 4e41261ab70958fc0dc6f5a02e2fed2e47f8940a04362b09bb58f653a1b8818dfb29bb6bb3f69f6c59d7f940eb613b78a082268ec9973a39a77a2b845529e898
SSDEEP 3072:FR3+syO0OcqFcnAEmQJ6yd+um3mc3nVn/G+Bz:/33yOdcSCAZHEgnpz
MD5 SHA1 SHA512 SSDEEP

Submit Download

wnvqhwx.exe

Path C:\Users\Admin\AppData\Local\Temp\wnvqhwx.exe
Size 165KB
SHA256 daf2ab042ff533f2053f03abbaf2a6461490a4048979ae131b8a9716bf51e142
MD5 756c50b6fb4ef9ed3a9aabaae2ef9ea1
SHA1 e8e9b199c81d6e1e104b4a023970c904fb01a68a
SHA512 4e41261ab70958fc0dc6f5a02e2fed2e47f8940a04362b09bb58f653a1b8818dfb29bb6bb3f69f6c59d7f940eb613b78a082268ec9973a39a77a2b845529e898
SSDEEP 3072:FR3+syO0OcqFcnAEmQJ6yd+um3mc3nVn/G+Bz:/33yOdcSCAZHEgnpz
MD5 SHA1 SHA512 SSDEEP

Submit Download

wnvqhwx.exe

Path C:\Users\Admin\AppData\Local\Temp\wnvqhwx.exe
Size 165KB
SHA256 daf2ab042ff533f2053f03abbaf2a6461490a4048979ae131b8a9716bf51e142
MD5 756c50b6fb4ef9ed3a9aabaae2ef9ea1
SHA1 e8e9b199c81d6e1e104b4a023970c904fb01a68a
SHA512 4e41261ab70958fc0dc6f5a02e2fed2e47f8940a04362b09bb58f653a1b8818dfb29bb6bb3f69f6c59d7f940eb613b78a082268ec9973a39a77a2b845529e898
SSDEEP 3072:FR3+syO0OcqFcnAEmQJ6yd+um3mc3nVn/G+Bz:/33yOdcSCAZHEgnpz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3608-7-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3608-10-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3608-11-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3608-13-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3608-14-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4468-5-0x0000000001360000-0x0000000001362000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads