General
-
Target
PRICEENQUIRY-RFQ6000073650.001.rar
-
Size
726KB
-
Sample
241101-td7jqssgjn
-
MD5
ba9eac386fd51ffad8a6cc3c314d603c
-
SHA1
49efb40d4ab9a14e9b0180247044a2b30300e936
-
SHA256
1a5ee558806484195096af9678c6d1e09217687cad7e3c1cea053b2e6dbcd6d1
-
SHA512
659302ad13c7548b70dc416ea1750f7e6feccbe6de1a4a5b8239a5adc1618d69e6ee6ece6203f442e3f6a6f14c4125baa49942a2e185f7d9edf5b43bd4112062
-
SSDEEP
12288:v8eQ4gk34WVBsjftqqeqO6wd59TCgukmu0KZNtGfTypDmOj+Z8zKIVYDkWbN7Zj:v8b5Qsjftf3hkmuR7uyp1j+rmYDkm9
Static task
static1
Behavioral task
behavioral1
Sample
PRICE ENQUIRY - RFQ 6000073650.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
PRICE ENQUIRY - RFQ 6000073650.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Malware Config
Extracted
azorult
http://e3z1.shop/HT341/index.php
Targets
-
-
Target
PRICE ENQUIRY - RFQ 6000073650.exe
-
Size
744KB
-
MD5
8083cf732510be4c79e5b6ce228765ea
-
SHA1
f4b6508156d8d61bf534b56e9a02087b597c9417
-
SHA256
4d5b8d11a093fb86a961c2bf87aca48a4e2a27bc1dda6e79092691948a84a4b8
-
SHA512
4c42bf57b384405745ea291c7096bf3ec75eb12dcffb2707ac07326171c2333ea90212059df5ea7f5b6fdc6ac432dcd145657e2dceb96cc2036a82211639edaa
-
SSDEEP
12288:ekjX33ZlEIdYwTqOWdMVDiDzemOlsf4+q2d13i95XynWAElsT1dsuH:ZH3ZlE2YoqKwqmvfC23kxTeTn
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Azorult family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
-
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
fc90dfb694d0e17b013d6f818bce41b0
-
SHA1
3243969886d640af3bfa442728b9f0dff9d5f5b0
-
SHA256
7fe77ca13121a113c59630a3dba0c8aaa6372e8082393274da8f8608c4ce4528
-
SHA512
324f13aa7a33c6408e2a57c3484d1691ecee7c3c1366de2bb8978c8dc66b18425d8cab5a32d1702c13c43703e36148a022263de7166afdce141da2b01169f1c6
-
SSDEEP
192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk
Score3/10 -
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
7Credentials In Files
6Credentials in Registry
1