azorult | 7529ef8411e4bf746c734e3dd43ca2e75457a3a36e80b2fba6dda03fd18e1251

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-03-2024 20:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1296-72-0x0000000000400000-0x0000000000422000-memory.exe
Size

136KB
MD5

f7e4591e9b5d24e9b2024b6c218f0c7f
SHA1

5582a3722a714cc9ee57e9c46a62731910d01874
SHA256

7529ef8411e4bf746c734e3dd43ca2e75457a3a36e80b2fba6dda03fd18e1251
SHA512

c774b3b7fef1972180ed50fa34422fd1a00c5bc1e9ee24deb1970fd15421dc964c09aff1a4a8029f0a4caacdbff23231187f87c2fd1002a7ad10971fe981f07d
SSDEEP

3072:hExRaQ6raoCoCyz6/mqv1JR+yBtGOeaeWgiRqgM:yaO1tme++wigH

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://bll5e.shop/dbkl/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Executes dropped EXE 2 IoCs

Processes:

FB_4125.tmp.exeFB_41C2.tmp.exe

pid process

2752 FB_4125.tmp.exe
2524 FB_41C2.tmp.exe

pid	process
2752	FB_4125.tmp.exe
2524	FB_41C2.tmp.exe

Loads dropped DLL 4 IoCs

Processes:

1296-72-0x0000000000400000-0x0000000000422000-memory.exe

pid	process
1940	1296-72-0x0000000000400000-0x0000000000422000-memory.exe
1940	1296-72-0x0000000000400000-0x0000000000422000-memory.exe
1940	1296-72-0x0000000000400000-0x0000000000422000-memory.exe
1940	1296-72-0x0000000000400000-0x0000000000422000-memory.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

1296-72-0x0000000000400000-0x0000000000422000-memory.exe

description	pid	process	target process
PID 1940 wrote to memory of 2752	1940	1296-72-0x0000000000400000-0x0000000000422000-memory.exe	FB_4125.tmp.exe
PID 1940 wrote to memory of 2752	1940	1296-72-0x0000000000400000-0x0000000000422000-memory.exe	FB_4125.tmp.exe
PID 1940 wrote to memory of 2752	1940	1296-72-0x0000000000400000-0x0000000000422000-memory.exe	FB_4125.tmp.exe
PID 1940 wrote to memory of 2752	1940	1296-72-0x0000000000400000-0x0000000000422000-memory.exe	FB_4125.tmp.exe
PID 1940 wrote to memory of 2524	1940	1296-72-0x0000000000400000-0x0000000000422000-memory.exe	FB_41C2.tmp.exe
PID 1940 wrote to memory of 2524	1940	1296-72-0x0000000000400000-0x0000000000422000-memory.exe	FB_41C2.tmp.exe
PID 1940 wrote to memory of 2524	1940	1296-72-0x0000000000400000-0x0000000000422000-memory.exe	FB_41C2.tmp.exe
PID 1940 wrote to memory of 2524	1940	1296-72-0x0000000000400000-0x0000000000422000-memory.exe	FB_41C2.tmp.exe

C:\Users\Admin\AppData\Local\Temp\1296-72-0x0000000000400000-0x0000000000422000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1296-72-0x0000000000400000-0x0000000000422000-memory.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Users\Admin\AppData\Local\Temp\FB_4125.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\FB_4125.tmp.exe"
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Users\Admin\AppData\Local\Temp\FB_41C2.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\FB_41C2.tmp.exe"
  2⤵
  - Executes dropped EXE
  PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FB_4125.tmp.exe

Filesize
3KB

MD5
74bafb3e707c7b0c63938ac200f99c7f

SHA1
10c5506337845ed9bf25c73d2506f9c15ab8e608

SHA256
129450ba06ad589cf6846a455a5b6b5f55e164ee4906e409eb692ab465269689

SHA512
5b24dc5acd14f812658e832b587b60695fb16954fca006c2c3a7382ef0ec65c3bd1aaf699425c49ff3cceef16869e75dd6f00ec189b9f673f08f7e1b80cf7781

Download Submit
\Users\Admin\AppData\Local\Temp\FB_41C2.tmp.exe

Filesize
112KB

MD5
2dd2c9bac5fb8aaad15d3b6b86ca5579

SHA1
4a4c8c3f3b625ef05f52c5169e6f20c2c0f7821d

SHA256
6d7ada69aa8260a1c9d4108a03258468bd050603be333e4f8b2f85c79de0338c

SHA512
8b5a936fecb66b7d1fa5e12b9a2cd3145d0fec8e56dc66dfdd8ed6b306c036028c2f74b228bb5b284a5886c19093e0ba12486f3374f5e917e19ee56510d865f7

Download Submit
memory/2524-18-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download