azorult | cd28fdc0ba5ed24ae7ef0916f835cb8eacaffe2f339da2081edf1de791223ec9

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 07:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Doc#0001275758.exe
Size

23KB
MD5

707ba46eb0f294c67a804e2602212127
SHA1

db9249fc6afe1b3cf4cf93f0994772c4309a9a95
SHA256

cd28fdc0ba5ed24ae7ef0916f835cb8eacaffe2f339da2081edf1de791223ec9
SHA512

123616aeaba21a7b077628416e574f2bea5113915d1dc33b0b9177bf1c599ef2a4deebdcbd94ad852ba333bb6ef52e462ed3f748b589f535c71b37c89edfe4a4
SSDEEP

384:I353XicKxFQ7jrOKOcRD5WOnYPLpFzDGHJzOFzDGsT8JN77hhQ33:qGxEh5WOEBDGpzOBDGsI3hGH

Score

10^/10

azorult infostealer persistence trojan

Malware Config

Extracted

Family

azorult

http://hqt3.shop/DBL841/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fetpeaemndo = "C:\\Users\\Admin\\AppData\\Roaming\\Fetpeaemndo.exe"	Doc#0001275758.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2440 set thread context of 4160	2440	Doc#0001275758.exe	99

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2440	Doc#0001275758.exe
Token: SeDebugPrivilege	2440	Doc#0001275758.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 4160	2440	Doc#0001275758.exe	99
PID 2440 wrote to memory of 4160	2440	Doc#0001275758.exe	99
PID 2440 wrote to memory of 4160	2440	Doc#0001275758.exe	99
PID 2440 wrote to memory of 4160	2440	Doc#0001275758.exe	99
PID 2440 wrote to memory of 4160	2440	Doc#0001275758.exe	99
PID 2440 wrote to memory of 4160	2440	Doc#0001275758.exe	99
PID 2440 wrote to memory of 4160	2440	Doc#0001275758.exe	99
PID 2440 wrote to memory of 4160	2440	Doc#0001275758.exe	99
PID 2440 wrote to memory of 4160	2440	Doc#0001275758.exe	99

C:\Users\Admin\AppData\Local\Temp\Doc#0001275758.exe
"C:\Users\Admin\AppData\Local\Temp\Doc#0001275758.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\Doc#0001275758.exe
  "C:\Users\Admin\AppData\Local\Temp\Doc#0001275758.exe"
  2⤵
  PID:4160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2440-41-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-4895-0x00000000747F0000-0x0000000074FA0000-memory.dmp

Filesize
7.7MB

Download
memory/2440-2-0x00000000747F0000-0x0000000074FA0000-memory.dmp

Filesize
7.7MB

Download
memory/2440-3-0x0000000006A30000-0x0000000006C5A000-memory.dmp

Filesize
2.2MB

Download
memory/2440-4-0x0000000007210000-0x00000000077B4000-memory.dmp

Filesize
5.6MB

Download
memory/2440-5-0x0000000006D60000-0x0000000006DF2000-memory.dmp

Filesize
584KB

Download
memory/2440-7-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-11-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-19-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-33-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-39-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-37-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-35-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-31-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-9-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-27-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-25-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-23-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-21-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-17-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-15-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-13-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-29-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-1-0x0000000000F80000-0x0000000000F88000-memory.dmp

Filesize
32KB

Download
memory/2440-65-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-50-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-59-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-57-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-53-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-51-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-67-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-69-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-0-0x00000000747FE000-0x00000000747FF000-memory.dmp

Filesize
4KB

Download
memory/2440-63-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-61-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-55-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-45-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-43-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-47-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-4892-0x00000000747F0000-0x0000000074FA0000-memory.dmp

Filesize
7.7MB

Download
memory/2440-4893-0x0000000006370000-0x00000000063D6000-memory.dmp

Filesize
408KB

Download
memory/2440-4894-0x00000000066B0000-0x00000000066FC000-memory.dmp

Filesize
304KB

Download
memory/2440-6-0x0000000006A30000-0x0000000006C54000-memory.dmp

Filesize
2.1MB

Download
memory/2440-4896-0x00000000747F0000-0x0000000074FA0000-memory.dmp

Filesize
7.7MB

Download
memory/2440-4897-0x0000000006710000-0x0000000006764000-memory.dmp

Filesize
336KB

Download
memory/2440-4904-0x00000000747F0000-0x0000000074FA0000-memory.dmp

Filesize
7.7MB

Download
memory/4160-4903-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4160-4905-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads