Analysis
- max time kernel
146s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20250211-en - resource tags
- submitted
14/02/2025, 06:47
General
- Target Ziraat Bankasi Swift Mesaji.exe
- Size 1.6MB
- Sample250214-hkab2awkfr
- SHA256 bc77cf4119389ffce479674f64d1c365141507b4324064cd31ec78d9f3f90dc0
Malware Config
Extracted
-
azorult
-
http://gdm5.icu/HL341/index.php
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- Azorult family
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 22 IoCs
- Loads dropped DLL 4 IoCs
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Drops file in System32 directory 31 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 64 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 48 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JuGiqLILT.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JuGiqLILT" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1827.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 16882⤵
- Program crash
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDk4NTY1RUMtRTRGQS00RkQ0LUIwQjYtMzE4NUNGMDUyRkQzfSIgdXNlcmlkPSJ7Njg5Mzc0N0EtQjY2MC00MTM0LUFBNzEtQ0I3OTVFMEVEQjkzfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7Q0Y3QzlCNjEtNkJGNy00N0QzLTk0MUYtQjlFMTQ4RjVCNzhBfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODIxNjkiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1MzE4NTEwMTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0NzY2MDY2MDA5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1552 -ip 15521⤵
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
7z.exe
7zFM.exe
7zG.exe
Uninstall.exe
AppVShNotify.exe
IntegratedOffice.exe
MavInject32.exe
OfficeC2RClient.exe
appvcleaner.exe
LICLUA.EXE
OSE.EXE
VSTOInstaller.exe
chrmstp.exe
setup.exe
chrome_pwa_launcher.exe
elevation_service.exe
notification_helper.exe
chrome_proxy.exe
appletviewer.exe
extcheck.exe
idlj.exe
jabswitch.exe
jar.exe
jarsigner.exe
java-rmi.exe
java.exe
wmpnetwk.exe
dotnet.exe
powershell.exe.log
StartupProfileData-NonInteractive
mozglue.dll
msvcp140.dll
nss3.dll
vcruntime140.dll
__PSScriptPolicyTest_vk0wevzj.jl4.ps1
tmp1827.tmp
perfhost.exe
AgentService.exe
DiagnosticsHub.StandardCollector.Service.exe
FXSSVC.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
SearchIndexer.exe
SensorDataService.exe
Spectrum.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
AppVClient.exe
SgrmBroker.exe
msiexec.exe
memory/1120-289-0x0000000140000000-0x00000001401C0000-memory.dmp
memory/1120-277-0x0000000140000000-0x00000001401C0000-memory.dmp
memory/1552-0-0x00000000742FE000-0x00000000742FF000-memory.dmp
memory/1552-2-0x0000000005800000-0x0000000005DA4000-memory.dmp
memory/1552-3-0x00000000052F0000-0x0000000005382000-memory.dmp
memory/1552-7-0x00000000742FE000-0x00000000742FF000-memory.dmp
memory/1552-5-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/1552-143-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/1552-8-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/1552-10-0x0000000006680000-0x00000000067FA000-memory.dmp
memory/1552-6-0x0000000005290000-0x00000000052A4000-memory.dmp
memory/1552-1-0x00000000006E0000-0x000000000087E000-memory.dmp
memory/1552-4-0x0000000005280000-0x000000000528A000-memory.dmp
memory/1552-11-0x0000000008AB0000-0x0000000008B4C000-memory.dmp
memory/1568-409-0x0000000140000000-0x000000014011C000-memory.dmp
memory/1568-235-0x0000000140000000-0x000000014011C000-memory.dmp
memory/1612-468-0x0000000140000000-0x0000000140169000-memory.dmp
memory/1612-247-0x0000000140000000-0x0000000140169000-memory.dmp
memory/2104-698-0x0000000140000000-0x0000000140216000-memory.dmp
memory/2104-327-0x0000000140000000-0x0000000140216000-memory.dmp
memory/2340-276-0x0000000140000000-0x000000014013F000-memory.dmp
memory/2340-134-0x0000000000CE0000-0x0000000000D40000-memory.dmp
memory/2340-133-0x0000000140000000-0x000000014013F000-memory.dmp
memory/2396-110-0x00000000001A0000-0x0000000000200000-memory.dmp
memory/2396-104-0x00000000001A0000-0x0000000000200000-memory.dmp
memory/2396-112-0x0000000140000000-0x000000014022B000-memory.dmp
memory/2396-260-0x0000000140000000-0x000000014022B000-memory.dmp
memory/2636-56-0x0000000000710000-0x0000000000770000-memory.dmp
memory/2636-62-0x0000000140000000-0x0000000140130000-memory.dmp
memory/2636-208-0x0000000140000000-0x0000000140130000-memory.dmp
memory/2636-63-0x0000000000710000-0x0000000000770000-memory.dmp
memory/2692-31-0x0000000000400000-0x0000000000534000-memory.dmp
memory/2692-37-0x0000000002C40000-0x0000000002CA7000-memory.dmp
memory/2692-25-0x0000000000400000-0x0000000000534000-memory.dmp
memory/2692-32-0x0000000002C40000-0x0000000002CA7000-memory.dmp
memory/2840-291-0x0000000140000000-0x0000000140155000-memory.dmp
memory/2840-154-0x0000000140000000-0x0000000140155000-memory.dmp
memory/2988-261-0x0000000140000000-0x0000000140188000-memory.dmp
memory/2988-530-0x0000000140000000-0x0000000140188000-memory.dmp
memory/3012-80-0x0000000005A80000-0x0000000005ACC000-memory.dmp
memory/3012-223-0x0000000006D90000-0x0000000006D9A000-memory.dmp
memory/3012-79-0x00000000059E0000-0x00000000059FE000-memory.dmp
memory/3012-317-0x0000000007040000-0x0000000007048000-memory.dmp
memory/3012-174-0x000000006EFC0000-0x000000006F00C000-memory.dmp
memory/3012-195-0x0000000006C20000-0x0000000006CC3000-memory.dmp
memory/3012-24-0x00000000053D0000-0x0000000005724000-memory.dmp
memory/3128-209-0x0000000140000000-0x000000014011B000-memory.dmp
memory/3148-123-0x0000000140000000-0x0000000140155000-memory.dmp
memory/3148-126-0x0000000001A50000-0x0000000001AB0000-memory.dmp
memory/3148-128-0x0000000140000000-0x0000000140155000-memory.dmp
memory/3148-121-0x0000000001A50000-0x0000000001AB0000-memory.dmp
memory/3148-115-0x0000000001A50000-0x0000000001AB0000-memory.dmp
memory/3260-355-0x0000000140000000-0x00000001401D7000-memory.dmp
memory/3260-699-0x0000000140000000-0x00000001401D7000-memory.dmp
memory/3260-222-0x0000000140000000-0x00000001401D7000-memory.dmp
memory/3504-172-0x0000000007000000-0x0000000007032000-memory.dmp
memory/3504-212-0x0000000007340000-0x000000000735A000-memory.dmp
memory/3504-173-0x000000006EFC0000-0x000000006F00C000-memory.dmp
memory/3504-192-0x00000000065D0000-0x00000000065EE000-memory.dmp
memory/3504-197-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/3504-23-0x0000000005950000-0x00000000059B6000-memory.dmp
memory/3504-22-0x0000000005110000-0x0000000005176000-memory.dmp
memory/3504-211-0x0000000007990000-0x000000000800A000-memory.dmp
memory/3504-169-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/3504-155-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/3504-248-0x00000000075C0000-0x0000000007656000-memory.dmp
memory/3504-262-0x0000000007540000-0x0000000007551000-memory.dmp
memory/3504-21-0x0000000005070000-0x0000000005092000-memory.dmp
memory/3504-19-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/3504-301-0x0000000007570000-0x000000000757E000-memory.dmp
memory/3504-303-0x0000000007580000-0x0000000007594000-memory.dmp
memory/3504-18-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/3504-17-0x00000000051B0000-0x00000000057D8000-memory.dmp
memory/3504-357-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/3504-316-0x0000000007680000-0x000000000769A000-memory.dmp
memory/3504-16-0x00000000026F0000-0x0000000002726000-memory.dmp
memory/3648-562-0x0000000140000000-0x0000000140168000-memory.dmp
memory/3648-273-0x0000000140000000-0x0000000140168000-memory.dmp
memory/3692-305-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3692-170-0x0000000140000000-0x0000000140131000-memory.dmp
memory/4036-306-0x0000000140000000-0x00000001401FC000-memory.dmp
memory/4036-690-0x0000000140000000-0x00000001401FC000-memory.dmp
memory/4308-88-0x0000000000720000-0x0000000000780000-memory.dmp
memory/4308-131-0x0000000140000000-0x0000000140135000-memory.dmp
memory/4308-82-0x0000000000720000-0x0000000000780000-memory.dmp
memory/4308-90-0x0000000140000000-0x0000000140135000-memory.dmp
memory/4308-129-0x0000000000720000-0x0000000000780000-memory.dmp
memory/4660-198-0x0000000000400000-0x000000000051D000-memory.dmp
memory/4952-689-0x0000000140000000-0x0000000140147000-memory.dmp
memory/4952-300-0x0000000140000000-0x0000000140147000-memory.dmp
memory/4988-77-0x0000000140000000-0x000000014012F000-memory.dmp
memory/4988-75-0x0000000000690000-0x00000000006F0000-memory.dmp
memory/4988-69-0x0000000000690000-0x00000000006F0000-memory.dmp
memory/5072-246-0x0000000140000000-0x0000000140234000-memory.dmp
memory/5072-99-0x0000000000820000-0x0000000000880000-memory.dmp
memory/5072-93-0x0000000000820000-0x0000000000880000-memory.dmp
memory/5072-101-0x0000000140000000-0x0000000140234000-memory.dmp
memory/5160-330-0x0000000140000000-0x000000014014C000-memory.dmp
memory/5160-700-0x0000000140000000-0x000000014014C000-memory.dmp
memory/5344-701-0x0000000140000000-0x0000000140179000-memory.dmp
memory/5344-356-0x0000000140000000-0x0000000140179000-memory.dmp