azorult | c4f52acd406bc725b166739ea9a85ac80c4ecb0ba9c8c7ef32660912ed2749f4

General

Target

Q-1479-R-FRONTLINE.exe
Size

1.9MB
MD5

53e3342cba72b85c7f0450d9ffc20139
SHA1

7d5938767ca1c30f697f8d94de6f0ae69c99cbd8
SHA256

c4f52acd406bc725b166739ea9a85ac80c4ecb0ba9c8c7ef32660912ed2749f4
SHA512

c4b683f7f378a76f50435356f6dcf917398f2accc1d7841ede1e9bc869e56dab9bffb650e8dedca526fa49e1fa1935484f421a69f8703aa8637f0467d1ee312e
SSDEEP

49152:wp6OlSXZoTetdC4O4TvRK2yrmA7BHH4u9xkfL:9e+vOOK2y6kFH9KfL

Score

10^/10

azorult guloader downloader infostealer trojan

Malware Config

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Loads dropped DLL 1 IoCs

Processes:

Q-1479-R-FRONTLINE.exe

pid process

3060 Q-1479-R-FRONTLINE.exe

pid	process
3060	Q-1479-R-FRONTLINE.exe

Drops file in System32 directory 2 IoCs

Processes:

Q-1479-R-FRONTLINE.exesvchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rabbinats\Balefire.lnk	Q-1479-R-FRONTLINE.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\microsoft\IdentityCRL\production\tmpidcrl.dll	svchost.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

Q-1479-R-FRONTLINE.exe

pid process

3348 Q-1479-R-FRONTLINE.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Q-1479-R-FRONTLINE.exeQ-1479-R-FRONTLINE.exe

pid process

3060 Q-1479-R-FRONTLINE.exe
3348 Q-1479-R-FRONTLINE.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Q-1479-R-FRONTLINE.exe

description pid process target process

PID 3060 set thread context of 3348 3060 Q-1479-R-FRONTLINE.exe Q-1479-R-FRONTLINE.exe
Drops file in Program Files directory 1 IoCs

Processes:

Q-1479-R-FRONTLINE.exe

description ioc process

File opened for modification C:\Program Files (x86)\skyggeregeringer.ini Q-1479-R-FRONTLINE.exe

pid	process
3348	Q-1479-R-FRONTLINE.exe

pid	process
3060	Q-1479-R-FRONTLINE.exe
3348	Q-1479-R-FRONTLINE.exe

description	pid	process	target process
PID 3060 set thread context of 3348	3060	Q-1479-R-FRONTLINE.exe	Q-1479-R-FRONTLINE.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\skyggeregeringer.ini	Q-1479-R-FRONTLINE.exe

Drops file in Windows directory 4 IoCs

Processes:

Q-1479-R-FRONTLINE.exe

description	ioc	process
File opened for modification	C:\Windows\resources\0409\Grnsvr\reservebeholdningens.ini	Q-1479-R-FRONTLINE.exe
File opened for modification	C:\Windows\resources\psychophysicist.beh	Q-1479-R-FRONTLINE.exe
File opened for modification	C:\Windows\Fonts\Cheville.sti	Q-1479-R-FRONTLINE.exe
File opened for modification	C:\Windows\autoophuggere\pandoridae.unm	Q-1479-R-FRONTLINE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02zgpvuofpbxyeqa	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-3802588206-2855991289-4225012448-1000\02kxhgljuhejaqqg\DeviceId = "<Data><User username=\"02KXHGLJUHEJAQQG\"/></Data>\r\n"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02zgpvuofpbxyeqa\DeviceId = "<Data LastUpdatedTime=\"1702587859\"><User username=\"02ZGPVUOFPBXYEQA\"><HardwareInfo BoundTime=\"1702587859\" TpmKeyStateClient=\"1\" TpmKeyStateServer=\"3\" LicenseKeySequence=\"1\"/></User></Data>\r\n"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-3802588206-2855991289-4225012448-1000	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-3802588206-2855991289-4225012448-1000\02kxhgljuhejaqqg\DeviceId = "<Data><User username=\"02KXHGLJUHEJAQQG\"><HardwareInfo BoundTime=\"1702587860\" TpmKeyStateClient=\"0\" TpmKeyStateServer=\"0\"/></User></Data>\r\n"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02zgpvuofpbxyeqa\Provision Thursday, December 14, 2023 21:04:18 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAU6fYvcw2Bk+CirqRE6wA9gAAAAACAAAAAAAQZgAAAAEAACAAAADwEsVW0XKxUmdSqIlL8fV3a6jt1zlHUSUVWyikGSH5bwAAAAAOgAAAAAIAACAAAAC6MGF6dvvY3/STkqMPtXuPGDxbhxeldLISOFVsdDaGMSAAAABs0XFp82HDftrhymhoZnOMyCk8YfqxVMk9PWpFO3rdV0AAAACUOQ1rVAWNNZ51TA2B5Yigqm9untaQLhpCTjm9bCb4fXN6rR4UFYK0zyN/uLpIGBns5PHqGq4igqYy5Jpn1x3B"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\ValidDeviceId = "02zgpvuofpbxyeqa"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02zgpvuofpbxyeqa	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-3802588206-2855991289-4225012448-1000\02kxhgljuhejaqqg\AppIdList = "{AFDA72BF-3409-413A-B54E-2AB8D66A7826};"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-3802588206-2855991289-4225012448-1000\ValidDeviceId = "02kxhgljuhejaqqg"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-3802588206-2855991289-4225012448-1000\02kxhgljuhejaqqg	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "0018800C68E7989B"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02zgpvuofpbxyeqa\DeviceId = "<Data LastUpdatedTime=\"1702587859\"><User username=\"02ZGPVUOFPBXYEQA\"/></Data>\r\n"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02zgpvuofpbxyeqa\AppIdList = "{AFDA72BF-3409-413A-B54E-2AB8D66A7826};"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02zgpvuofpbxyeqa\DeviceId = "<Data LastUpdatedTime=\"1702587859\"><User username=\"02ZGPVUOFPBXYEQA\"><HardwareInfo BoundTime=\"1702587860\" TpmKeyStateClient=\"1\" TpmKeyStateServer=\"3\" LicenseKeySequence=\"1\"/></User></Data>\r\n"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Q-1479-R-FRONTLINE.exe

pid process

3060 Q-1479-R-FRONTLINE.exe

pid	process
3060	Q-1479-R-FRONTLINE.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

Q-1479-R-FRONTLINE.exe

description	pid	process	target process
PID 3060 wrote to memory of 3348	3060	Q-1479-R-FRONTLINE.exe	Q-1479-R-FRONTLINE.exe
PID 3060 wrote to memory of 3348	3060	Q-1479-R-FRONTLINE.exe	Q-1479-R-FRONTLINE.exe
PID 3060 wrote to memory of 3348	3060	Q-1479-R-FRONTLINE.exe	Q-1479-R-FRONTLINE.exe
PID 3060 wrote to memory of 3348	3060	Q-1479-R-FRONTLINE.exe	Q-1479-R-FRONTLINE.exe
PID 3060 wrote to memory of 3348	3060	Q-1479-R-FRONTLINE.exe	Q-1479-R-FRONTLINE.exe

C:\Users\Admin\AppData\Local\Temp\Q-1479-R-FRONTLINE.exe
"C:\Users\Admin\AppData\Local\Temp\Q-1479-R-FRONTLINE.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Users\Admin\AppData\Local\Temp\Q-1479-R-FRONTLINE.exe
  "C:\Users\Admin\AppData\Local\Temp\Q-1479-R-FRONTLINE.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s wlidsvc
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

Filesize
26KB

MD5
6f6a6e38715c9b3838f95e03fa0567f3

SHA1
40bffba8deebcfa89ff78591d1697290a8f8145d

SHA256
b1eab91db2cb293c153d0cb5ebf1ac3a9d50ac75d050403e8b9e1ec68881bd5f

SHA512
b1ecc5e8aff711a0ec8aa9d8415e1b26b06bc8e5607f26baba34506c30849b091e2fb3ea7051471000640c869aa9024e09749cbeac5595c16a4806d15f3221c2

Download Submit
\Users\Admin\AppData\Local\Temp\nsaBAC5.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
memory/3060-42-0x0000000003FB0000-0x000000000624C000-memory.dmp

Filesize
34.6MB

Download
memory/3060-37-0x0000000003FB0000-0x000000000624C000-memory.dmp

Filesize
34.6MB

Download
memory/3060-38-0x00007FF9A6870000-0x00007FF9A6A4B000-memory.dmp

Filesize
1.9MB

Download
memory/3060-39-0x0000000077231000-0x0000000077344000-memory.dmp

Filesize
1.1MB

Download
memory/3060-40-0x00000000731A0000-0x00000000731A7000-memory.dmp

Filesize
28KB

Download
memory/3348-44-0x00000000772B6000-0x00000000772B7000-memory.dmp

Filesize
4KB

Download
memory/3348-43-0x00007FF9A6870000-0x00007FF9A6A4B000-memory.dmp

Filesize
1.9MB

Download
memory/3348-56-0x0000000071E10000-0x0000000073193000-memory.dmp

Filesize
19.5MB

Download
memory/3348-57-0x00000000004C0000-0x000000000275C000-memory.dmp

Filesize
34.6MB

Download
memory/3348-58-0x0000000000060000-0x0000000000087000-memory.dmp

Filesize
156KB

Download
memory/3348-59-0x00000000004C0000-0x000000000275C000-memory.dmp

Filesize
34.6MB

Download
memory/3348-60-0x0000000071E10000-0x0000000073193000-memory.dmp

Filesize
19.5MB

Download
memory/3348-61-0x0000000077231000-0x0000000077344000-memory.dmp

Filesize
1.1MB

Download
memory/3348-41-0x00000000004C0000-0x000000000275C000-memory.dmp

Filesize
34.6MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads