Analysis

  • max time kernel
    134s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14-12-2024 18:13

General

  • Target

    Azorult3.3.exe

  • Size

    1.1MB

  • MD5

    b91fe4c246efc048b78c9e162754a7a9

  • SHA1

    15e1c4fe989290b07b60f93340476a9ba025bfa9

  • SHA256

    d6af1ba026c010e4d006842da28b478419bbc4c711f907a28c52079bc7fea1bf

  • SHA512

    4538a437fb2241ee38b1ab256618bbf2ea752bab92146fbf9138c6dd9585c5a5291155e19c6004372c925f300c0c7cfa87b7dfc467b556e8dbab092d8d04a2d2

  • SSDEEP

    24576:KMyijQZ+ZJLXrfQRTJ6/aIRQbhB0LrKqk:/D0Z+ZZr4RT/I2dB0yqk

Malware Config

Extracted

Family

xworm

C2

146.190.110.91:3389

Attributes
  • Install_directory

    %AppData%

  • install_file

    svchost.exe

  • telegram

    https://api.telegram.org/bot7023899363:AAFEzgbfWzhyE32Lf95TKSRYEYXMd4AfMyk/sendMessage?chat_id=6354844663

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Azorult family
  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Azorult3.3.exe
    "C:\Users\Admin\AppData\Local\Temp\Azorult3.3.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2288
    • C:\Users\Admin\AppData\Local\Temp\Azorult 3.3.exe
      "C:\Users\Admin\AppData\Local\Temp\Azorult 3.3.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2760
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2652
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2556
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2856
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2848
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1204
    • C:\ProgramData\csrss.exe
      "C:\ProgramData\csrss.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2836
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\csrss.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2620
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'csrss.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2160
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\csrss.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1032
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'csrss.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2364
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:744

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\csrss.exe

    Filesize

    30KB

    MD5

    0998890ccf8a3d8702db7a84fe6dd7b3

    SHA1

    18e561e0ef68fb08d8f391eacd45c7d573206b92

    SHA256

    c33e1408ea96b9ea7a72d44d7742effb4a98776711b7c94c4997a155af61b220

    SHA512

    8132312fb66a9d947eef3f625a4c18b8e640cec51616d0a9fd756e028d1bac5677f5de9a53c3ed32186cb238e8c46613b8c3d6641a6a953d7961412b030c6dd1

  • C:\Users\Admin\AppData\Local\Temp\Azorult 3.3.exe

    Filesize

    1.3MB

    MD5

    8440a861c68965a66c009b140e1bee47

    SHA1

    801a8c77156a2c6cbc5899f36c961dc8fdc56665

    SHA256

    a8add4815bce2e26df3cd492c5686e22ab842bfa52c68af3f33c23adb820d06f

    SHA512

    c42903216f9f35368d41853ae96aaa7a7a07ce0730ca99b26909b98f5525b4fd772e0868c683fae0ca71730c0586ad3130be4ef3e6af68e299a933d9accca266

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZQG71ASNOVP3ZJ0SMHK4.temp

    Filesize

    7KB

    MD5

    9658f8123c1aa245cf7bedd7eeafe4ca

    SHA1

    f6dc662de0b43239df16e8525d8790d9a6bdb541

    SHA256

    0129dece261f348288a5ef2440b92c7934c9461010f575aa32d43f906365d731

    SHA512

    5135fface94b5e4900062c177130f7ddde31d25e9afca5853f5d1adc5788461c1db457a7573843a4d5787b811a62b8f133bdbf982b5d8f1fda80b20124e708a3

  • C:\Users\Admin\AppData\Roaming\svchost.exe

    Filesize

    67KB

    MD5

    50dce71a753bad01a07904f2af283123

    SHA1

    1beab766071ddeff0c8e577c6717debcee0d21e6

    SHA256

    8fb751033d1546ce28f5dcef171857ee879bdd31d76be2ae556f246c258473f3

    SHA512

    7cdc64dcfa8a0cbc1375a1878f560beb083cd9778ff67c5c0f1b693927c35365b384affc9dc33cade4aeaafded11ac328001a18ccb34a559678c1f50fa886c01

  • memory/1032-57-0x000000001B580000-0x000000001B862000-memory.dmp

    Filesize

    2.9MB

  • memory/1204-75-0x0000000002790000-0x0000000002798000-memory.dmp

    Filesize

    32KB

  • memory/2160-45-0x00000000027E0000-0x00000000027E8000-memory.dmp

    Filesize

    32KB

  • memory/2160-44-0x000000001B5A0000-0x000000001B882000-memory.dmp

    Filesize

    2.9MB

  • memory/2288-0-0x000007FEF55D3000-0x000007FEF55D4000-memory.dmp

    Filesize

    4KB

  • memory/2288-24-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp

    Filesize

    9.9MB

  • memory/2288-12-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp

    Filesize

    9.9MB

  • memory/2288-1-0x0000000000C10000-0x0000000000D2E000-memory.dmp

    Filesize

    1.1MB

  • memory/2620-37-0x000000001B790000-0x000000001BA72000-memory.dmp

    Filesize

    2.9MB

  • memory/2620-38-0x0000000001D20000-0x0000000001D28000-memory.dmp

    Filesize

    32KB

  • memory/2652-19-0x00000000010C0000-0x00000000010D8000-memory.dmp

    Filesize

    96KB

  • memory/2760-27-0x0000000000A90000-0x0000000000AF8000-memory.dmp

    Filesize

    416KB

  • memory/2760-26-0x0000000000300000-0x0000000000306000-memory.dmp

    Filesize

    24KB

  • memory/2760-25-0x0000000000360000-0x00000000004BA000-memory.dmp

    Filesize

    1.4MB

  • memory/2836-23-0x00000000000C0000-0x00000000000CE000-memory.dmp

    Filesize

    56KB