azorult | b41299f66011a48cbf7fb2cc797b27a1c3fdbb8e6eeb4221fd39b2e758711d1a

General

Target

e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe
Size

1.1MB
MD5

e6e45c67f2ce89b5b212b6c202d8e303
SHA1

c1592971e40a2324a1db433c8ac718868332b440
SHA256

b41299f66011a48cbf7fb2cc797b27a1c3fdbb8e6eeb4221fd39b2e758711d1a
SHA512

b9b76b51dbe6c215e45d03ecc71a68d324a9178dcee31fe729bbd5f71ee3f7eaa053e0712907f6eb731dedabc573ecc3e2f876878a24c79220aa989a8a227b26
SSDEEP

24576:/AHnh+eWsN3skA4RV1Hom2KXMmHaQ6lTH9JNeILmrQ15:ih+ZkldoPK8YaZjrq2

Score

10^/10

azorult discovery infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://185.195.236.168/1gw3/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Executes dropped EXE 6 IoCs

Processes:

SIHClient.exeSIHClient.exeSIHClient.exeSIHClient.exeSIHClient.exeSIHClient.exe

pid process

2824 SIHClient.exe
2716 SIHClient.exe
2140 SIHClient.exe
1852 SIHClient.exe
856 SIHClient.exe
776 SIHClient.exe
Loads dropped DLL 3 IoCs

Processes:

SIHClient.exeSIHClient.exeSIHClient.exe

pid process

2824 SIHClient.exe
2140 SIHClient.exe
856 SIHClient.exe

pid	process
2824	SIHClient.exe
2716	SIHClient.exe
2140	SIHClient.exe
1852	SIHClient.exe
856	SIHClient.exe
776	SIHClient.exe

pid	process
2824	SIHClient.exe
2140	SIHClient.exe
856	SIHClient.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\RdpSa\SIHClient.exe	autoit_exe

Drops file in System32 directory 3 IoCs

Processes:

SIHClient.exeSIHClient.exeSIHClient.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\winmgmts:\root\cimv2	SIHClient.exe
File opened for modification	C:\Windows\SysWOW64\winmgmts:\root\cimv2	SIHClient.exe
File opened for modification	C:\Windows\SysWOW64\winmgmts:\root\cimv2	SIHClient.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exeSIHClient.exeSIHClient.exeSIHClient.exe

description	pid	process	target process
PID 2500 set thread context of 2192	2500	e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe	e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe
PID 2824 set thread context of 2716	2824	SIHClient.exe	SIHClient.exe
PID 2140 set thread context of 1852	2140	SIHClient.exe	SIHClient.exe
PID 856 set thread context of 776	856	SIHClient.exe	SIHClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

schtasks.exeSIHClient.exeschtasks.exeSIHClient.exeSIHClient.exeschtasks.exeSIHClient.exeSIHClient.exeschtasks.exee6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exee6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exeSIHClient.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SIHClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SIHClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SIHClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SIHClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SIHClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SIHClient.exe

NTFS ADS 1 IoCs

Processes:

e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\root\cimv2	e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

2880 schtasks.exe
2612 schtasks.exe
2836 schtasks.exe
2288 schtasks.exe

pid	process
2880	schtasks.exe
2612	schtasks.exe
2836	schtasks.exe
2288	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exeSIHClient.exeSIHClient.exeSIHClient.exe

pid	process
2500	e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe
2500	e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe
2824	SIHClient.exe
2824	SIHClient.exe
2140	SIHClient.exe
2140	SIHClient.exe
856	SIHClient.exe
856	SIHClient.exe

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exetaskeng.exeSIHClient.exeSIHClient.exeSIHClient.exe

description	pid	process	target process
PID 2500 wrote to memory of 2192	2500	e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe	e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe
PID 2500 wrote to memory of 2192	2500	e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe	e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe
PID 2500 wrote to memory of 2192	2500	e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe	e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe
PID 2500 wrote to memory of 2192	2500	e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe	e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe
PID 2500 wrote to memory of 2192	2500	e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe	e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe
PID 2500 wrote to memory of 2192	2500	e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe	e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe
PID 2500 wrote to memory of 2880	2500	e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe	schtasks.exe
PID 2500 wrote to memory of 2880	2500	e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe	schtasks.exe
PID 2500 wrote to memory of 2880	2500	e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe	schtasks.exe
PID 2500 wrote to memory of 2880	2500	e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe	schtasks.exe
PID 2936 wrote to memory of 2824	2936	taskeng.exe	SIHClient.exe
PID 2936 wrote to memory of 2824	2936	taskeng.exe	SIHClient.exe
PID 2936 wrote to memory of 2824	2936	taskeng.exe	SIHClient.exe
PID 2936 wrote to memory of 2824	2936	taskeng.exe	SIHClient.exe
PID 2824 wrote to memory of 2716	2824	SIHClient.exe	SIHClient.exe
PID 2824 wrote to memory of 2716	2824	SIHClient.exe	SIHClient.exe
PID 2824 wrote to memory of 2716	2824	SIHClient.exe	SIHClient.exe
PID 2824 wrote to memory of 2716	2824	SIHClient.exe	SIHClient.exe
PID 2824 wrote to memory of 2716	2824	SIHClient.exe	SIHClient.exe
PID 2824 wrote to memory of 2716	2824	SIHClient.exe	SIHClient.exe
PID 2824 wrote to memory of 2612	2824	SIHClient.exe	schtasks.exe
PID 2824 wrote to memory of 2612	2824	SIHClient.exe	schtasks.exe
PID 2824 wrote to memory of 2612	2824	SIHClient.exe	schtasks.exe
PID 2824 wrote to memory of 2612	2824	SIHClient.exe	schtasks.exe
PID 2936 wrote to memory of 2140	2936	taskeng.exe	SIHClient.exe
PID 2936 wrote to memory of 2140	2936	taskeng.exe	SIHClient.exe
PID 2936 wrote to memory of 2140	2936	taskeng.exe	SIHClient.exe
PID 2936 wrote to memory of 2140	2936	taskeng.exe	SIHClient.exe
PID 2140 wrote to memory of 1852	2140	SIHClient.exe	SIHClient.exe
PID 2140 wrote to memory of 1852	2140	SIHClient.exe	SIHClient.exe
PID 2140 wrote to memory of 1852	2140	SIHClient.exe	SIHClient.exe
PID 2140 wrote to memory of 1852	2140	SIHClient.exe	SIHClient.exe
PID 2140 wrote to memory of 1852	2140	SIHClient.exe	SIHClient.exe
PID 2140 wrote to memory of 1852	2140	SIHClient.exe	SIHClient.exe
PID 2140 wrote to memory of 2836	2140	SIHClient.exe	schtasks.exe
PID 2140 wrote to memory of 2836	2140	SIHClient.exe	schtasks.exe
PID 2140 wrote to memory of 2836	2140	SIHClient.exe	schtasks.exe
PID 2140 wrote to memory of 2836	2140	SIHClient.exe	schtasks.exe
PID 2936 wrote to memory of 856	2936	taskeng.exe	SIHClient.exe
PID 2936 wrote to memory of 856	2936	taskeng.exe	SIHClient.exe
PID 2936 wrote to memory of 856	2936	taskeng.exe	SIHClient.exe
PID 2936 wrote to memory of 856	2936	taskeng.exe	SIHClient.exe
PID 856 wrote to memory of 776	856	SIHClient.exe	SIHClient.exe
PID 856 wrote to memory of 776	856	SIHClient.exe	SIHClient.exe
PID 856 wrote to memory of 776	856	SIHClient.exe	SIHClient.exe
PID 856 wrote to memory of 776	856	SIHClient.exe	SIHClient.exe
PID 856 wrote to memory of 776	856	SIHClient.exe	SIHClient.exe
PID 856 wrote to memory of 776	856	SIHClient.exe	SIHClient.exe
PID 856 wrote to memory of 2288	856	SIHClient.exe	schtasks.exe
PID 856 wrote to memory of 2288	856	SIHClient.exe	schtasks.exe
PID 856 wrote to memory of 2288	856	SIHClient.exe	schtasks.exe
PID 856 wrote to memory of 2288	856	SIHClient.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Users\Admin\AppData\Local\Temp\e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\e6e45c67f2ce89b5b212b6c202d8e303_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2192
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn OpenWith /tr "C:\Users\Admin\RdpSa\SIHClient.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2880

C:\Windows\system32\taskeng.exe
taskeng.exe {B7124679-79BE-446A-B589-F439B76D5CA6} S-1-5-21-3533259084-2542256011-65585152-1000:XPAJOTIY\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Users\Admin\RdpSa\SIHClient.exe
  C:\Users\Admin\RdpSa\SIHClient.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Users\Admin\RdpSa\SIHClient.exe
    "C:\Users\Admin\RdpSa\SIHClient.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2716
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\SysWOW64\schtasks.exe" /create /tn OpenWith /tr "C:\Users\Admin\RdpSa\SIHClient.exe" /sc minute /mo 1 /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2612
- C:\Users\Admin\RdpSa\SIHClient.exe
  C:\Users\Admin\RdpSa\SIHClient.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Users\Admin\RdpSa\SIHClient.exe
    "C:\Users\Admin\RdpSa\SIHClient.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1852
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\SysWOW64\schtasks.exe" /create /tn OpenWith /tr "C:\Users\Admin\RdpSa\SIHClient.exe" /sc minute /mo 1 /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2836
- C:\Users\Admin\RdpSa\SIHClient.exe
  C:\Users\Admin\RdpSa\SIHClient.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Users\Admin\RdpSa\SIHClient.exe
    "C:\Users\Admin\RdpSa\SIHClient.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:776
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\SysWOW64\schtasks.exe" /create /tn OpenWith /tr "C:\Users\Admin\RdpSa\SIHClient.exe" /sc minute /mo 1 /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\OpenWith.lnk

Filesize
729B

MD5
55992930bb99db03caac69e5843ab545

SHA1
e9d10e482b47047b454ddf8f399f56f1173c8585

SHA256
17d3563d2fe3f6236ce97277245a72cde1406321ae189bc6b984721f8270e125

SHA512
e114848e5220bb2b4bd49bf0255ba8b10b8fa4c110150e248435da389c150f1c81e26a382804385ec978c488fbf18939e020c7894ab21f814e33c2a8d06f3a59

Download Submit
C:\Users\Admin\OpenWith.lnk

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\RdpSa\SIHClient.exe

Filesize
1.1MB

MD5
d1fd7a13912cddb3d4ff3eb7f73affce

SHA1
25fa885097a0009ec2907e95ea1b0cf18342d97a

SHA256
9ec25e077704c8c5466133302bc6f79585c4d89677081d16027a286e2a09d3fe

SHA512
d3d75c66ac7ced44595857cb88823a89e713b037a4c8d093097615ed03c82a5bc706b0710add43c1fafe6b6373abbd1954347a2fd8bfd74ccfb5e22a36ec4ae5

Download Submit
memory/1852-38-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2192-13-0x00000000001B0000-0x00000000001D0000-memory.dmp

Filesize
128KB

Download
memory/2192-9-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2192-3-0x00000000001B0000-0x00000000001D0000-memory.dmp

Filesize
128KB

Download
memory/2192-1-0x00000000001B0000-0x00000000001D0000-memory.dmp

Filesize
128KB

Download
memory/2500-0-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/2716-24-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2716-21-0x0000000000080000-0x00000000000A0000-memory.dmp

Filesize
128KB

Download
memory/2716-28-0x0000000000080000-0x00000000000A0000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads