azorult | 3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574

General

Target

3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe
Size

681KB
MD5

7fe2322db3d58f5b993fadbaaff908be
SHA1

1d715a90d9874e61d90c0c84a1095887009c53b2
SHA256

3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574
SHA512

097198970785255e89747b9f67c79528a92a50d490e3e8c7c441fd76d6110bf192ed26d1573b7023dc28f54e01917586ea2ec6d50e58e6eb1efb3f168022a9b6
SSDEEP

12288:bsCza+8quapcNxkVO4S2ojdbTv2dSFW7QkgzV7cwRTrjEzNWVtL70:vza+v0QoJvOuofgzVowRTfEzgVZY

Score

10^/10

azorult discovery infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://168.119.251.131/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe

description	pid	process	target process
PID 3056 set thread context of 2728	3056	3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe	3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe

description	pid	process	target process
PID 3056 wrote to memory of 2728	3056	3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe	3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe
PID 3056 wrote to memory of 2728	3056	3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe	3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe
PID 3056 wrote to memory of 2728	3056	3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe	3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe
PID 3056 wrote to memory of 2728	3056	3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe	3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe
PID 3056 wrote to memory of 2728	3056	3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe	3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe
PID 3056 wrote to memory of 2728	3056	3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe	3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe
PID 3056 wrote to memory of 2728	3056	3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe	3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe
PID 3056 wrote to memory of 2728	3056	3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe	3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe
PID 3056 wrote to memory of 2728	3056	3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe	3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe
PID 3056 wrote to memory of 2728	3056	3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe	3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe

C:\Users\Admin\AppData\Local\Temp\3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe
"C:\Users\Admin\AppData\Local\Temp\3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056

C:\Users\Admin\AppData\Local\Temp\3f8807728cce4b1e55293cd3577fdd36457c1568a23594d4cbfaeab45a10c574.exe
"{path}"
2⤵
- System Location Discovery: System Language Discovery
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2728-19-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2728-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2728-22-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2728-21-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2728-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2728-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2728-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2728-17-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2728-11-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2728-13-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3056-4-0x0000000074BB0000-0x000000007515B000-memory.dmp

Filesize
5.7MB

Download
memory/3056-1-0x0000000074BB0000-0x000000007515B000-memory.dmp

Filesize
5.7MB

Download
memory/3056-0-0x0000000074BB1000-0x0000000074BB2000-memory.dmp

Filesize
4KB

Download
memory/3056-20-0x0000000074BB0000-0x000000007515B000-memory.dmp

Filesize
5.7MB

Download
memory/3056-3-0x0000000074BB0000-0x000000007515B000-memory.dmp

Filesize
5.7MB

Download
memory/3056-2-0x0000000074BB0000-0x000000007515B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads