azorult | d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727

General

Target

d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe
Size

622KB
MD5

9aae07beb10162a2d525dd3aad707e26
SHA1

387c1cd54061a21941b366d15700c462c5cd2e96
SHA256

d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727
SHA512

f31c57173a48db8620dd952bc0180aa6557a0a656e0df6168b5c62eae39fa90547ef350fde10b747bc2c4996c6e22f7f1f4750a63469fe1dd91d5b821575f325
SSDEEP

12288:MkKnLVq69Hrc82yTPZodHtRWztKK7RG1Jz8Ap2x9c8Q04fz/sGoisDsCVVLuSjFs:AQy6ONsqLumFHnHzFTrS

Score

10^/10

azorult guloader downloader infostealer trojan

Malware Config

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Loads dropped DLL 1 IoCs

Processes:

d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe

pid process

4180 d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe

pid process

1820 d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe

pid	process
1820	d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exed9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe

pid	process
4180	d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe
1820	d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe

description	pid	process	target process
PID 4180 set thread context of 1820	4180	d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe	d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe

Drops file in Windows directory 1 IoCs

Processes:

d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe

description	ioc	process
File opened for modification	C:\Windows\Fonts\stepdansers\milieubeskyttelseslovene.ini	d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe

pid process

4180 d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe

description	pid	process	target process
PID 4180 wrote to memory of 1820	4180	d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe	d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe
PID 4180 wrote to memory of 1820	4180	d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe	d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe
PID 4180 wrote to memory of 1820	4180	d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe	d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe
PID 4180 wrote to memory of 1820	4180	d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe	d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe
PID 4180 wrote to memory of 1820	4180	d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe	d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe

C:\Users\Admin\AppData\Local\Temp\d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe
"C:\Users\Admin\AppData\Local\Temp\d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4180

C:\Users\Admin\AppData\Local\Temp\d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe
"C:\Users\Admin\AppData\Local\Temp\d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727.exe"
2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd5B9E.tmp\System.dll

Filesize
11KB

MD5
17ed1c86bd67e78ade4712be48a7d2bd

SHA1
1cc9fe86d6d6030b4dae45ecddce5907991c01a0

SHA256
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

SHA512
0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

Download Submit
memory/1820-22-0x0000000000060000-0x0000000000087000-memory.dmp

Filesize
156KB

Download
memory/1820-11-0x0000000001740000-0x0000000004331000-memory.dmp

Filesize
43.9MB

Download
memory/1820-13-0x0000000077148000-0x0000000077149000-memory.dmp

Filesize
4KB

Download
memory/1820-14-0x0000000077165000-0x0000000077166000-memory.dmp

Filesize
4KB

Download
memory/1820-21-0x00000000004E0000-0x0000000001734000-memory.dmp

Filesize
18.3MB

Download
memory/1820-23-0x00000000004E0000-0x0000000001734000-memory.dmp

Filesize
18.3MB

Download
memory/1820-24-0x0000000001740000-0x0000000004331000-memory.dmp

Filesize
43.9MB

Download
memory/1820-25-0x00000000770C1000-0x00000000771E1000-memory.dmp

Filesize
1.1MB

Download
memory/4180-9-0x00000000770C1000-0x00000000771E1000-memory.dmp

Filesize
1.1MB

Download
memory/4180-10-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/4180-12-0x0000000004BB0000-0x00000000077A1000-memory.dmp

Filesize
43.9MB

Download
memory/4180-8-0x0000000004BB0000-0x00000000077A1000-memory.dmp

Filesize
43.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads