azorult | b32d33a5000986d02db5ef08b47d33dd32c208c8fcd328c14f29798838f8c000

General

Target

8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe
Size

876KB
MD5

8925082557f9ff4e72f7dc0bd2ee0c9c
SHA1

056d1a930e31e5ce58d836b827d203d9fe60af2a
SHA256

8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4
SHA512

7a807cb16f029ee13e5bef886bbdaaff343ffb7e9def24e6a5b053d2235719cefaf6aa742d2af5d9200cbc3407cc445a0e12f08c63f62dff73bc25b06cd2493e
SSDEEP

12288:5XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXV:8sGRdrEAbm4zesGRdrEAbm4zMX06eyM

Score

10^/10

azorult discovery infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://cafirepacks.com/pub/fon/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

Processes:

8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe

description	pid	process	target process
PID 2352 set thread context of 1844	2352	8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe	8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe

pid	process
1844	8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe
1844	8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe
1844	8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe
1844	8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe
1844	8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe
1844	8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe
1844	8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe
1844	8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe
1844	8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe

pid process

2352 8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe

pid process

2352 8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe

pid	process
2352	8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe

pid	process
2352	8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe

description	pid	process	target process
PID 2352 wrote to memory of 1844	2352	8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe	8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe
PID 2352 wrote to memory of 1844	2352	8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe	8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe
PID 2352 wrote to memory of 1844	2352	8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe	8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe
PID 2352 wrote to memory of 1844	2352	8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe	8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe
PID 2352 wrote to memory of 1844	2352	8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe	8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe

C:\Users\Admin\AppData\Local\Temp\8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe
"C:\Users\Admin\AppData\Local\Temp\8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Users\Admin\AppData\Local\Temp\8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe
  "C:\Users\Admin\AppData\Local\Temp\8e717d95d5e1039d3effeebbc38bf00facd5ced07e9c40c5c37b32a11026d0c4.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1844-65-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1844-66-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1844-68-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1844-53-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1844-57-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1844-64-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2352-51-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2352-25-0x0000000000690000-0x0000000000790000-memory.dmp

Filesize
1024KB

Download
memory/2352-30-0x0000000000690000-0x0000000000790000-memory.dmp

Filesize
1024KB

Download
memory/2352-46-0x0000000000690000-0x0000000000790000-memory.dmp

Filesize
1024KB

Download
memory/2352-47-0x0000000000690000-0x0000000000790000-memory.dmp

Filesize
1024KB

Download
memory/2352-50-0x0000000000690000-0x0000000000790000-memory.dmp

Filesize
1024KB

Download
memory/2352-24-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2352-56-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2352-58-0x0000000000690000-0x0000000000790000-memory.dmp

Filesize
1024KB

Download
memory/2352-63-0x00000000002A0000-0x00000000002A8000-memory.dmp

Filesize
32KB

Download
memory/2352-31-0x0000000000690000-0x0000000000790000-memory.dmp

Filesize
1024KB

Download
memory/2352-32-0x0000000000690000-0x0000000000790000-memory.dmp

Filesize
1024KB

Download
memory/2352-62-0x0000000000690000-0x0000000000790000-memory.dmp

Filesize
1024KB

Download
memory/2352-61-0x0000000000690000-0x0000000000790000-memory.dmp

Filesize
1024KB

Download
memory/2352-59-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2352-29-0x0000000000690000-0x0000000000790000-memory.dmp

Filesize
1024KB

Download
memory/2352-55-0x0000000000690000-0x0000000000790000-memory.dmp

Filesize
1024KB

Download
memory/2352-26-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2352-52-0x0000000000690000-0x0000000000790000-memory.dmp

Filesize
1024KB

Download
memory/2352-28-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2352-27-0x0000000000690000-0x0000000000790000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads