azorult | a620e855497074b6da1cc6ae56b19c3e2e251f6a9b4f43bb0beef655287b3eed

General

Target

CITIUS33XXX10307051121001177.exe
Size

337KB
MD5

bce638f50587c46faa3c3e1798100251
SHA1

7b354d3902b1af13cc17cf4ec0c4da111309956d
SHA256

3b1fd9ce0c20b167a2367191a5129c5f635869f6a87f473cfe083e67d7f7465b
SHA512

18445d9cd7bf41946817dae07652e2f4e9c0f14e98c90941c30b304fb70667aa79f4b5603f60d73bcd7bcca611bee7ac1d0601b278121c311de917b8e26e5c9f
SSDEEP

6144:rGioWWuuTKFIIfn9pbghCwAehEPKb0iwRaazRZYJ:2uumFIWTbfZeEyIiYaeRZYJ

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://89.43.107.198/mpom/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Executes dropped EXE 2 IoCs

Processes:

ucxgm.exeucxgm.exe

pid process

1684 ucxgm.exe
2908 ucxgm.exe
Loads dropped DLL 5 IoCs

Processes:

CITIUS33XXX10307051121001177.exeucxgm.exeWerFault.exe

pid process

340 CITIUS33XXX10307051121001177.exe
1684 ucxgm.exe
2560 WerFault.exe
2560 WerFault.exe
2560 WerFault.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2560 2908 WerFault.exe ucxgm.exe

pid	process
1684	ucxgm.exe
2908	ucxgm.exe

pid	process
340	CITIUS33XXX10307051121001177.exe
1684	ucxgm.exe
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe

pid	pid_target	process	target process
2560	2908	WerFault.exe	ucxgm.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

CITIUS33XXX10307051121001177.exeucxgm.exeucxgm.exe

description	pid	process	target process
PID 340 wrote to memory of 1684	340	CITIUS33XXX10307051121001177.exe	ucxgm.exe
PID 340 wrote to memory of 1684	340	CITIUS33XXX10307051121001177.exe	ucxgm.exe
PID 340 wrote to memory of 1684	340	CITIUS33XXX10307051121001177.exe	ucxgm.exe
PID 340 wrote to memory of 1684	340	CITIUS33XXX10307051121001177.exe	ucxgm.exe
PID 1684 wrote to memory of 2908	1684	ucxgm.exe	ucxgm.exe
PID 1684 wrote to memory of 2908	1684	ucxgm.exe	ucxgm.exe
PID 1684 wrote to memory of 2908	1684	ucxgm.exe	ucxgm.exe
PID 1684 wrote to memory of 2908	1684	ucxgm.exe	ucxgm.exe
PID 1684 wrote to memory of 2908	1684	ucxgm.exe	ucxgm.exe
PID 1684 wrote to memory of 2908	1684	ucxgm.exe	ucxgm.exe
PID 1684 wrote to memory of 2908	1684	ucxgm.exe	ucxgm.exe
PID 1684 wrote to memory of 2908	1684	ucxgm.exe	ucxgm.exe
PID 1684 wrote to memory of 2908	1684	ucxgm.exe	ucxgm.exe
PID 1684 wrote to memory of 2908	1684	ucxgm.exe	ucxgm.exe
PID 1684 wrote to memory of 2908	1684	ucxgm.exe	ucxgm.exe
PID 2908 wrote to memory of 2560	2908	ucxgm.exe	WerFault.exe
PID 2908 wrote to memory of 2560	2908	ucxgm.exe	WerFault.exe
PID 2908 wrote to memory of 2560	2908	ucxgm.exe	WerFault.exe
PID 2908 wrote to memory of 2560	2908	ucxgm.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\CITIUS33XXX10307051121001177.exe
"C:\Users\Admin\AppData\Local\Temp\CITIUS33XXX10307051121001177.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:340
- C:\Users\Admin\AppData\Local\Temp\ucxgm.exe
  C:\Users\Admin\AppData\Local\Temp\ucxgm.exe C:\Users\Admin\AppData\Local\Temp\joszbi
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Users\Admin\AppData\Local\Temp\ucxgm.exe
    C:\Users\Admin\AppData\Local\Temp\ucxgm.exe C:\Users\Admin\AppData\Local\Temp\joszbi
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 120
      4⤵
      Loads dropped DLL
      Program crash
      PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\joszbi

Filesize
5KB

MD5
a5a523f60a17756e61e17ba513ff59d1

SHA1
d03b444c7c2d4ffb34d483427e69ec2116d90951

SHA256
5519ce10c332d304d521a15d902d84e2feac7827a148284713402de837fd4755

SHA512
99af33e2deb545c902c8663a67643b18ae2ee09924c8dee23c4ed93a6ff55305c020e3fd4e2d3781144450b14468c08799a3c59dfd1151893ec1a7e8352ef08d

Download Submit
C:\Users\Admin\AppData\Local\Temp\jqrvq39gj49la

Filesize
211KB

MD5
664cb163be98c1035799694e2585cb16

SHA1
30984822dc25b065f6476557361396282906c551

SHA256
466b28f6c18c530ac94410a111fe1feb84b2363b03831cb3e39af96d37ad56cd

SHA512
e723882a67c072413357da1d9950a363ffcdb38fd1554cfede3acc75a16b6b78497a736fed7c32a5b8431a4ce591d3610da561ebbfee03ce04d6661e32612985

Download Submit
\Users\Admin\AppData\Local\Temp\ucxgm.exe

Filesize
179KB

MD5
78673699f5e78cf7ecfbb9ef42f3cc20

SHA1
7d1a1e230a595a3249f70871dfca54c1c7e6bb3e

SHA256
85f2460b17088ffbf8a4cfbbcf8c65340f538fe7e78603cf03adad566afc7838

SHA512
1f755d80bd66eea8ba8b0acbb9e2e8ba81d648671621ecd2407b680383e94269f7668840c9280dd75e176efb05cff25345438b43d3e82d71d9df865d759bb016

Download Submit
memory/1684-9-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/2908-12-0x00000000000C0000-0x00000000000E0000-memory.dmp

Filesize
128KB

Download
memory/2908-16-0x00000000000C0000-0x00000000000E0000-memory.dmp

Filesize
128KB

Download
memory/2908-19-0x00000000000C0000-0x00000000000E0000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing