azorult | 49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff

General

Target

49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe
Size

616KB
MD5

35642a19253d8919cb937152c8e9ce1d
SHA1

5811d05416ae2f3541dc4fb8386bcce9a023a4fe
SHA256

49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff
SHA512

d8c95b15cf549fda5b0bbd06fa24e49c645d4b553b0d2a9545b2b51d42e695a03f86436bb9cc360a67df4eded71bddaa0519312eaa09951c411b0935e55fd258
SSDEEP

12288:MkKnLVq69Hrc82yTPZodHtRWztKK7RG1Jz8Ap2x9c8Q04fz/sGoisDsCVVLyOwxM:AQy6ONsqLyOwxIETr2

Score

10^/10

azorult infostealer trojan

Malware Config

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Loads dropped DLL 1 IoCs

Processes:

49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe

pid process

2628 49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe

pid process

836 49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe

pid	process
836	49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe

pid	process
2628	49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe
836	49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe

description	pid	process	target process
PID 2628 set thread context of 836	2628	49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe	49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe

Drops file in Windows directory 1 IoCs

Processes:

49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe

description	ioc	process
File opened for modification	C:\Windows\Fonts\stepdansers\milieubeskyttelseslovene.ini	49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe

pid process

2628 49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe

description	pid	process	target process
PID 2628 wrote to memory of 836	2628	49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe	49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe
PID 2628 wrote to memory of 836	2628	49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe	49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe
PID 2628 wrote to memory of 836	2628	49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe	49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe
PID 2628 wrote to memory of 836	2628	49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe	49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe
PID 2628 wrote to memory of 836	2628	49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe	49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe

C:\Users\Admin\AppData\Local\Temp\49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe
"C:\Users\Admin\AppData\Local\Temp\49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2628

C:\Users\Admin\AppData\Local\Temp\49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe
"C:\Users\Admin\AppData\Local\Temp\49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff.exe"
2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsqA25B.tmp\System.dll

Filesize
11KB

MD5
17ed1c86bd67e78ade4712be48a7d2bd

SHA1
1cc9fe86d6d6030b4dae45ecddce5907991c01a0

SHA256
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

SHA512
0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

Download Submit
memory/836-10-0x0000000076F58000-0x0000000076F59000-memory.dmp

Filesize
4KB

Download
memory/836-11-0x0000000076F75000-0x0000000076F76000-memory.dmp

Filesize
4KB

Download
memory/836-21-0x00000000004E0000-0x0000000001734000-memory.dmp

Filesize
18.3MB

Download
memory/836-22-0x0000000000060000-0x0000000000087000-memory.dmp

Filesize
156KB

Download
memory/836-23-0x00000000004E0000-0x0000000001734000-memory.dmp

Filesize
18.3MB

Download
memory/836-24-0x0000000076ED1000-0x0000000076FF1000-memory.dmp

Filesize
1.1MB

Download
memory/2628-8-0x0000000076ED1000-0x0000000076FF1000-memory.dmp

Filesize
1.1MB

Download
memory/2628-9-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads