azorult | 28e978109eb024f0cf08e0d7b9f68408252ceb8f4388c9c4376b0af933ad0a69

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Doc#0001275758.exe
Size

213KB
MD5

668b66830072538bbc204738b4fce1ec
SHA1

bd6bd010e0cd0c0e73f6770734352bff321d0144
SHA256

35308eb46a0a14968e95e70014a28f149fee6d7ea3833b17556bea9a06a4218f
SHA512

e0d6cea2e1fec059142b3e38122c0773b66fdc2bfcd31b118eb305c9321c2034c2aca1d3f88dc0a27ffe6025cd14c2882daf7e2abde99f31c6474a6280cd5dc8
SSDEEP

3072:QbQw54d0TZ0tShfwUPnS21mQbnc+BR0pKREX/WONBuwrhmc7U1iIyx6IhNXOXcaa:jpdUZ0ts6uwrhmxicrFmnTAg

Score

10^/10

azorult infostealer persistence trojan

Malware Config

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\iunbq = "C:\\Users\\Admin\\AppData\\Roaming\\iunbq.exe"	Doc#0001275758.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2408 set thread context of 2028	2408	Doc#0001275758.exe	28

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2408	Doc#0001275758.exe
Token: SeDebugPrivilege	2408	Doc#0001275758.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2028	2408	Doc#0001275758.exe	28
PID 2408 wrote to memory of 2028	2408	Doc#0001275758.exe	28
PID 2408 wrote to memory of 2028	2408	Doc#0001275758.exe	28
PID 2408 wrote to memory of 2028	2408	Doc#0001275758.exe	28
PID 2408 wrote to memory of 2028	2408	Doc#0001275758.exe	28
PID 2408 wrote to memory of 2028	2408	Doc#0001275758.exe	28
PID 2408 wrote to memory of 2028	2408	Doc#0001275758.exe	28
PID 2408 wrote to memory of 2028	2408	Doc#0001275758.exe	28
PID 2408 wrote to memory of 2028	2408	Doc#0001275758.exe	28
PID 2408 wrote to memory of 2028	2408	Doc#0001275758.exe	28

C:\Users\Admin\AppData\Local\Temp\Doc#0001275758.exe
"C:\Users\Admin\AppData\Local\Temp\Doc#0001275758.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Local\Temp\Doc#0001275758.exe
  "C:\Users\Admin\AppData\Local\Temp\Doc#0001275758.exe"
  2⤵
  PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2408-0-0x0000000073F5E000-0x0000000073F5F000-memory.dmp

Filesize
4KB

Download
memory/2408-1-0x00000000002F0000-0x0000000000328000-memory.dmp

Filesize
224KB

Download
memory/2408-2-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download
memory/2408-3-0x00000000065A0000-0x00000000067CA000-memory.dmp

Filesize
2.2MB

Download
memory/2408-4-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-5-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-7-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-9-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-11-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-13-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-15-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-17-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-19-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-21-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-23-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-25-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-27-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-29-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-59-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-67-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-65-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-4891-0x0000000005A60000-0x0000000005AAC000-memory.dmp

Filesize
304KB

Download
memory/2408-4890-0x00000000058C0000-0x0000000005926000-memory.dmp

Filesize
408KB

Download
memory/2408-63-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-4892-0x0000000005C70000-0x0000000005CC4000-memory.dmp

Filesize
336KB

Download
memory/2408-61-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-57-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-55-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-53-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-52-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-50-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-47-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-45-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-43-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-41-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-39-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-37-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-35-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-33-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-31-0x00000000065A0000-0x00000000067C5000-memory.dmp

Filesize
2.1MB

Download
memory/2408-4907-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads