azorult | 67a6e13cfdbe0a70caa4e47dfce0c4113237a99f8183a70c5943edc842dcccb2

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
16-01-2024 07:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e-dekont.exe
Size

466KB
MD5

3977350112167b3fc2411a0f07232ab1
SHA1

c285f62ccb46fa2c7fa758c95efb5771ba19c2bc
SHA256

67a6e13cfdbe0a70caa4e47dfce0c4113237a99f8183a70c5943edc842dcccb2
SHA512

4de0f96b8808943d868d17965c185543376829dc1bd580495269d80aef50ecf2084c15506249b0440928f648b6325f414f58763c0849dd169e5b7bb61da80d2d
SSDEEP

12288:UiupmdZSki+DuaiONmJAkZQ+uwypDxfXikgqKeSGG:Uicmf5i+acg7XYDlykge3G

Score

10^/10

azorult guloader downloader infostealer trojan

Malware Config

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Loads dropped DLL 1 IoCs

Processes:

e-dekont.exe

pid process

3044 e-dekont.exe
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

e-dekont.exe

pid process

2788 e-dekont.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

e-dekont.exee-dekont.exe

pid process

3044 e-dekont.exe
2788 e-dekont.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

e-dekont.exe

description pid process target process

PID 3044 set thread context of 2788 3044 e-dekont.exe e-dekont.exe
Drops file in Program Files directory 1 IoCs

Processes:

e-dekont.exe

description ioc process

File opened for modification C:\Program Files (x86)\Hoffmann.ini e-dekont.exe
Drops file in Windows directory 1 IoCs

Processes:

e-dekont.exe

description ioc process

File opened for modification C:\Windows\resources\0409\electronarcosis.beg e-dekont.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

e-dekont.exe

pid process

3044 e-dekont.exe

pid	process
3044	e-dekont.exe

pid	process
2788	e-dekont.exe

pid	process
3044	e-dekont.exe
2788	e-dekont.exe

description	pid	process	target process
PID 3044 set thread context of 2788	3044	e-dekont.exe	e-dekont.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Hoffmann.ini	e-dekont.exe

description	ioc	process
File opened for modification	C:\Windows\resources\0409\electronarcosis.beg	e-dekont.exe

pid	process
3044	e-dekont.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

e-dekont.exe

description	pid	process	target process
PID 3044 wrote to memory of 2788	3044	e-dekont.exe	e-dekont.exe
PID 3044 wrote to memory of 2788	3044	e-dekont.exe	e-dekont.exe
PID 3044 wrote to memory of 2788	3044	e-dekont.exe	e-dekont.exe
PID 3044 wrote to memory of 2788	3044	e-dekont.exe	e-dekont.exe
PID 3044 wrote to memory of 2788	3044	e-dekont.exe	e-dekont.exe
PID 3044 wrote to memory of 2788	3044	e-dekont.exe	e-dekont.exe

C:\Users\Admin\AppData\Local\Temp\e-dekont.exe
"C:\Users\Admin\AppData\Local\Temp\e-dekont.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3044

C:\Users\Admin\AppData\Local\Temp\e-dekont.exe
"C:\Users\Admin\AppData\Local\Temp\e-dekont.exe"
2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nst45C8.tmp\System.dll

Filesize
11KB

MD5
3f176d1ee13b0d7d6bd92e1c7a0b9bae

SHA1
fe582246792774c2c9dd15639ffa0aca90d6fd0b

SHA256
fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

SHA512
0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

Download Submit
memory/2788-24-0x0000000072FD0000-0x0000000074032000-memory.dmp

Filesize
16.4MB

Download
memory/2788-28-0x0000000077C40000-0x0000000077D16000-memory.dmp

Filesize
856KB

Download
memory/2788-27-0x0000000077A50000-0x0000000077BF9000-memory.dmp

Filesize
1.7MB

Download
memory/2788-26-0x0000000000470000-0x00000000023B7000-memory.dmp

Filesize
31.3MB

Download
memory/2788-19-0x0000000000470000-0x00000000023B7000-memory.dmp

Filesize
31.3MB

Download
memory/2788-25-0x0000000072FD0000-0x0000000074032000-memory.dmp

Filesize
16.4MB

Download
memory/2788-21-0x0000000077A50000-0x0000000077BF9000-memory.dmp

Filesize
1.7MB

Download
memory/2788-22-0x0000000077C76000-0x0000000077C77000-memory.dmp

Filesize
4KB

Download
memory/2788-23-0x0000000072FD0000-0x0000000074032000-memory.dmp

Filesize
16.4MB

Download
memory/3044-18-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/3044-20-0x0000000003180000-0x00000000050C7000-memory.dmp

Filesize
31.3MB

Download
memory/3044-17-0x0000000077C40000-0x0000000077D16000-memory.dmp

Filesize
856KB

Download
memory/3044-16-0x0000000077A50000-0x0000000077BF9000-memory.dmp

Filesize
1.7MB

Download
memory/3044-15-0x0000000003180000-0x00000000050C7000-memory.dmp

Filesize
31.3MB

Download