azorult | cd28fdc0ba5ed24ae7ef0916f835cb8eacaffe2f339da2081edf1de791223ec9

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 07:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Doc#0001275758.exe
Size

23KB
MD5

707ba46eb0f294c67a804e2602212127
SHA1

db9249fc6afe1b3cf4cf93f0994772c4309a9a95
SHA256

cd28fdc0ba5ed24ae7ef0916f835cb8eacaffe2f339da2081edf1de791223ec9
SHA512

123616aeaba21a7b077628416e574f2bea5113915d1dc33b0b9177bf1c599ef2a4deebdcbd94ad852ba333bb6ef52e462ed3f748b589f535c71b37c89edfe4a4
SSDEEP

384:I353XicKxFQ7jrOKOcRD5WOnYPLpFzDGHJzOFzDGsT8JN77hhQ33:qGxEh5WOEBDGpzOBDGsI3hGH

Score

10^/10

azorult infostealer persistence trojan

Malware Config

Extracted

Family

azorult

http://hqt3.shop/DBL841/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Doc#0001275758.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fetpeaemndo = "C:\\Users\\Admin\\AppData\\Roaming\\Fetpeaemndo.exe"	Doc#0001275758.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Doc#0001275758.exe

description pid process target process

PID 1976 set thread context of 900 1976 Doc#0001275758.exe Doc#0001275758.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Doc#0001275758.exe

description pid process

Token: SeDebugPrivilege 1976 Doc#0001275758.exe
Token: SeDebugPrivilege 1976 Doc#0001275758.exe

description	pid	process	target process
PID 1976 set thread context of 900	1976	Doc#0001275758.exe	Doc#0001275758.exe

description	pid	process
Token: SeDebugPrivilege	1976	Doc#0001275758.exe
Token: SeDebugPrivilege	1976	Doc#0001275758.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

Doc#0001275758.exe

description	pid	process	target process
PID 1976 wrote to memory of 900	1976	Doc#0001275758.exe	Doc#0001275758.exe
PID 1976 wrote to memory of 900	1976	Doc#0001275758.exe	Doc#0001275758.exe
PID 1976 wrote to memory of 900	1976	Doc#0001275758.exe	Doc#0001275758.exe
PID 1976 wrote to memory of 900	1976	Doc#0001275758.exe	Doc#0001275758.exe
PID 1976 wrote to memory of 900	1976	Doc#0001275758.exe	Doc#0001275758.exe
PID 1976 wrote to memory of 900	1976	Doc#0001275758.exe	Doc#0001275758.exe
PID 1976 wrote to memory of 900	1976	Doc#0001275758.exe	Doc#0001275758.exe
PID 1976 wrote to memory of 900	1976	Doc#0001275758.exe	Doc#0001275758.exe
PID 1976 wrote to memory of 900	1976	Doc#0001275758.exe	Doc#0001275758.exe
PID 1976 wrote to memory of 900	1976	Doc#0001275758.exe	Doc#0001275758.exe

C:\Users\Admin\AppData\Local\Temp\Doc#0001275758.exe
"C:\Users\Admin\AppData\Local\Temp\Doc#0001275758.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976

C:\Users\Admin\AppData\Local\Temp\Doc#0001275758.exe
"C:\Users\Admin\AppData\Local\Temp\Doc#0001275758.exe"
2⤵
PID:900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-4911-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/900-4913-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1976-4890-0x0000000005670000-0x00000000056D6000-memory.dmp

Filesize
408KB

Download
memory/1976-5-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-4-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-67-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-7-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-9-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-11-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-13-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-15-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-27-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-29-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-33-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-35-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-39-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-43-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-65-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-49-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-55-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-61-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-4891-0x0000000005190000-0x00000000051DC000-memory.dmp

Filesize
304KB

Download
memory/1976-4912-0x0000000074AE0000-0x00000000751CE000-memory.dmp

Filesize
6.9MB

Download
memory/1976-3-0x00000000062C0000-0x00000000064EA000-memory.dmp

Filesize
2.2MB

Download
memory/1976-47-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-63-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-59-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-58-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-53-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-51-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-45-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-41-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-37-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-31-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-25-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-23-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-21-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-19-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-17-0x00000000062C0000-0x00000000064E4000-memory.dmp

Filesize
2.1MB

Download
memory/1976-4892-0x0000000074AEE000-0x0000000074AEF000-memory.dmp

Filesize
4KB

Download
memory/1976-4893-0x0000000074AE0000-0x00000000751CE000-memory.dmp

Filesize
6.9MB

Download
memory/1976-4894-0x0000000000690000-0x00000000006E4000-memory.dmp

Filesize
336KB

Download
memory/1976-2-0x0000000074AE0000-0x00000000751CE000-memory.dmp

Filesize
6.9MB

Download
memory/1976-0-0x0000000074AEE000-0x0000000074AEF000-memory.dmp

Filesize
4KB

Download
memory/1976-1-0x0000000000B70000-0x0000000000B78000-memory.dmp

Filesize
32KB

Download