azorult | 30e7a8d3ae31d83f3482b172d30306a26d953530453f0a3deb665546c130f939

General

Target

halveringer jordnr.exe
Size

611KB
MD5

c49991e6b3f2f5325ccc013fe758d724
SHA1

89421bf59eb12734b4ac73d78a566f8497f560b7
SHA256

30e7a8d3ae31d83f3482b172d30306a26d953530453f0a3deb665546c130f939
SHA512

678ccdb5d82f3a097df275399433437913c3070888eb95bf1b84e613b06a73927c00b36348b4e8a7d7d50900023a6d3f57f982aca3e590f3508d5410ca3af9d4
SSDEEP

12288:XBIJsQwcwlMdgSd82LvbsGQzW+M6uOCCp:eJsQwcvgnEOK6wCp

Score

10^/10

azorult discovery execution infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://h8m5b.shop/HH341/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2772	powershell.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
592	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2772	powershell.exe
592	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2772 set thread context of 592	2772	powershell.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	halveringer jordnr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2772	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2772	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2772	2432	halveringer jordnr.exe	31
PID 2432 wrote to memory of 2772	2432	halveringer jordnr.exe	31
PID 2432 wrote to memory of 2772	2432	halveringer jordnr.exe	31
PID 2432 wrote to memory of 2772	2432	halveringer jordnr.exe	31
PID 2772 wrote to memory of 592	2772	powershell.exe	34
PID 2772 wrote to memory of 592	2772	powershell.exe	34
PID 2772 wrote to memory of 592	2772	powershell.exe	34
PID 2772 wrote to memory of 592	2772	powershell.exe	34
PID 2772 wrote to memory of 592	2772	powershell.exe	34
PID 2772 wrote to memory of 592	2772	powershell.exe	34

C:\Users\Admin\AppData\Local\Temp\halveringer jordnr.exe
"C:\Users\Admin\AppData\Local\Temp\halveringer jordnr.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$Kermis=Get-Content 'C:\Users\Admin\AppData\Roaming\Palaeodictyopteron\testudskrivningsfaciliteters\Marinerede\Mopper\Taintable.mel';$Multinucleate=$Kermis.SubString(53881,3);.$Multinucleate($Kermis)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Program Files (x86)\windows mail\wab.exe
    "C:\Program Files (x86)\windows mail\wab.exe"
    3⤵
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Palaeodictyopteron\testudskrivningsfaciliteters\Marinerede\Mopper\Frigrende.Tju

Filesize
337KB

MD5
c35864f432f8124d2940edec9d91ec5f

SHA1
60793b2de8496a25d03bf51f6f3d0d01fa8ffe70

SHA256
eb532fcc7db829212b74ff342ef342f7569e0fd03ef7db6df30d78986b5f0b50

SHA512
42b20cd15175f147fc624906c93db13e97cc1b7348cdae90ef55829b4e132c5c77fe6364345b5d8fa3710f7b0f0799f625e364a794312da225058f1658b29fbe

Download Submit
C:\Users\Admin\AppData\Roaming\Palaeodictyopteron\testudskrivningsfaciliteters\Marinerede\Mopper\Taintable.mel

Filesize
52KB

MD5
1763bac7be70e285127db60c4d7ae9ed

SHA1
cb161a046f5aab4921ce40176012a249a964ece2

SHA256
a982b6b2969ebdc0cdd9986b0b7d3354b4464b3c050c198b6464038069294f55

SHA512
580845bd741cd7a15698e07e681940c9d1a4525d2ef9c3f833e38bbb08ae6c7ee91f814f2a71315557de99f1dc71b25876c9f6e3ce6ee229a4d7b555b3895bb3

Download Submit
memory/592-35-0x0000000000820000-0x0000000001882000-memory.dmp

Filesize
16.4MB

Download
memory/592-34-0x0000000000820000-0x0000000001882000-memory.dmp

Filesize
16.4MB

Download
memory/592-18-0x0000000000820000-0x0000000001882000-memory.dmp

Filesize
16.4MB

Download
memory/2772-8-0x00000000739C0000-0x0000000073F6B000-memory.dmp

Filesize
5.7MB

Download
memory/2772-13-0x00000000739C0000-0x0000000073F6B000-memory.dmp

Filesize
5.7MB

Download
memory/2772-15-0x00000000739C0000-0x0000000073F6B000-memory.dmp

Filesize
5.7MB

Download
memory/2772-16-0x0000000006690000-0x000000000B5C0000-memory.dmp

Filesize
79.2MB

Download
memory/2772-17-0x00000000739C0000-0x0000000073F6B000-memory.dmp

Filesize
5.7MB

Download
memory/2772-7-0x00000000739C1000-0x00000000739C2000-memory.dmp

Filesize
4KB

Download
memory/2772-10-0x00000000739C0000-0x0000000073F6B000-memory.dmp

Filesize
5.7MB

Download
memory/2772-9-0x00000000739C0000-0x0000000073F6B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing