azorult | 2b29b24f2a311158a4900bddf41fe482c42e46941a42468b4990fd467fde5f72

Analysis

max time kernel
7s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/01/2024, 11:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LPO_Eco_Environ(ARTWORK).exe
Size 614KB
Sample240131-m7fjsaceem
SHA256 2b29b24f2a311158a4900bddf41fe482c42e46941a42468b4990fd467fde5f72
MD5 91e8ae0f98abcb16814261421bfe1f6b
SHA1 36c17d7e22c982d4991749f905f70941c5d36825
SHA512 6ac7a1b0fdd7a8eaec7a9512a79cf70efb99213f76b1080e9ede42e511ff63c5d75565e0100a50b6f50e7ae36d23c98c09d01ac6be8abb23b0d835948a43aa74
SSDEEP 12288:MkKnLVq69Hrc82yTPZodHtRWztKK7RG1Jz8Ap2x9c8Q04fz/sGoisDsCVVLwOz3v:AQy6ONsqLN7UHZVrTrC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

azorult infostealer trojan

Malware Config

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\stepdansers\milieubeskyttelseslovene.ini	LPO_Eco_Environ(ARTWORK).exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1216	timeout.exe

C:\Users\Admin\AppData\Local\Temp\LPO_Eco_Environ(ARTWORK).exe
"C:\Users\Admin\AppData\Local\Temp\LPO_Eco_Environ(ARTWORK).exe"
1⤵
- Drops file in Windows directory
PID:636
- C:\Users\Admin\AppData\Local\Temp\LPO_Eco_Environ(ARTWORK).exe
  "C:\Users\Admin\AppData\Local\Temp\LPO_Eco_Environ(ARTWORK).exe"
  2⤵
  PID:1864
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "LPO_Eco_Environ(ARTWORK).exe"
    3⤵
    PID:4588
  - - C:\Windows\SysWOW64\timeout.exe
      C:\Windows\system32\timeout.exe 3
      4⤵
      Delays execution with timeout.exe
      PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mozglue.dll

Path C:\Users\Admin\AppData\Local\Temp\2001EC75\mozglue.dll
Size 135KB
SHA256 830533bb569594ec2f7c07896b90225006b90a9af108f49d6fb6bebd02428b2d
MD5 9e682f1eb98a9d41468fc3e50f907635
SHA1 85e0ceca36f657ddf6547aa0744f0855a27527ee
SHA512 230230722d61ac1089fabf3f2decfa04f9296498f8e2a2a49b1527797dca67b5a11ab8656f04087acadf873fa8976400d57c77c404eba4aff89d92b9986f32ed
SSDEEP 3072:8Oqe98Ea4usvd5jm6V0InXx/CHzGYC6NccMmxK3atIYHD2JJJsPyimY4kQkE:Vqe98Evua5Sm0ux/5YC6NccMmtXHD2JR
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\2001EC75\msvcp140.dll
Size 238KB
SHA256 7087008ee6b9f415f38f5729937119c5a62bedab681cfaf5960747b9924b176c
MD5 056647a239f16a805ec23f8663c3aacf
SHA1 2b54fcc39e60e284e9c7252420714d556a7ab8c7
SHA512 c64b7e91afc709218017d33431854d0d65b14964b5fb969f17e0d299f1ed54ce37e57db637a2ef5774bcc4dc55ce4d35c9455177c60e4a372f254b2ed549ea2a
SSDEEP 6144:ReNh9SB5numfrS/VF0YRIxBVEgM2ZPwr8Gk8G2fhrS/w25zY+dcPGm+gj8:Mlp4PwrPTlZ+/wKzY+dM+gj8
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\Users\Admin\AppData\Local\Temp\2001EC75\nss3.dll
Size 182KB
SHA256 06cc1565de57410283713f726531baaa1ccc2dbdbbe326db28ec3679a5b8a7f3
MD5 00ceae61be9016c95995269c152ff87a
SHA1 5cdb73e78bd07c86afef772fb7f3b8013a628e06
SHA512 50aeefba9ee91060963ad7e64b112e7f4643803e4e0b0502567bf11f3d6b53e0fe7b37165551468b541e3d80204115bec46482d5e6c2d06ac001e12236ddca32
SSDEEP 3072:GJ+ttiSAuxoNHfGTdgIxK3caXWWckFZqIoZdgzusH4u8WDXjMOw6wI6ueGdZuufN:XDAsaHfGJgIA3fXHFZDoZdCNDXGC6utZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\2001EC75\vcruntime140.dll
Size 81KB
SHA256 c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
MD5 7587bf9cb4147022cd5681b015183046
SHA1 f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA512 0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
SSDEEP 1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz5312.tmp\System.dll
Size 11KB
SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 17ed1c86bd67e78ade4712be48a7d2bd
SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/636-8-0x0000000077631000-0x0000000077751000-memory.dmp

Download

memory/636-9-0x0000000010000000-0x0000000010006000-memory.dmp

Download

memory/1864-10-0x00000000776B8000-0x00000000776B9000-memory.dmp

Download

memory/1864-23-0x00000000004E0000-0x0000000001734000-memory.dmp

Download

memory/1864-22-0x0000000000060000-0x0000000000087000-memory.dmp

Download

memory/1864-21-0x00000000004E0000-0x0000000001734000-memory.dmp

Download

memory/1864-11-0x00000000776D5000-0x00000000776D6000-memory.dmp

Download

memory/1864-132-0x0000000077631000-0x0000000077751000-memory.dmp

Download

memory/1864-131-0x00000000004E0000-0x0000000001734000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads