Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
31/10/2026, 00:16
General
- Target setup.exe
- Size 93KB
- Sample261031-aky2dstt6l
- SHA256 52e7f3cf0136b25a44525c41d482a6d12060baa2c5ad615fd8e21c310c20146d
Malware Config
Extracted
-
azalea
-
it
-
198.19.248.16:8080
-
UpdateOrchestratore3a8
-
xEbpdVpGMv3CnnKbLuSFmviqRV
-
EgkPRvdXmtxfZYaKeLasR8xnUbH3WmP8ZA3f
-
amsi_patch
true
-
av_exclusion_path
C:\Windows\Temp
-
beacon_interval_seconds
57
-
beacon_path
/api/telemetry
-
install
true
-
install_path
%UserProfile%\AppData\Roaming\qpaamv8\MicrosoftEdgeUpdate.exe
-
persistent_queue_path
%Temp%\ossqhn.dat
-
registry_key
SecurityHealthSystray
-
scheduled_task
MicrosoftEdgeUpdateTaskCore
-
uac_bypass
true
-
user_agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Signatures
- Family: Azalea
Azalea is a modular Windows RAT written in C#.
- Detects Azalea RAT 1 IoCs
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3992-0-0x0000023930740000-0x0000023930752000-memory.dmp
memory/3992-1-0x00000239320F0000-0x000002393210D000-memory.dmp
memory/3992-2-0x00007FFAE8780000-0x00007FFAE8781000-memory.dmp
memory/3992-5-0x00000239321F0000-0x0000023932200000-memory.dmp
memory/3992-6-0x000002394B400000-0x000002394B5E2000-memory.dmp
memory/3992-7-0x00000239321F0000-0x0000023932200000-memory.dmp
memory/3992-8-0x000002394B220000-0x000002394B2C8000-memory.dmp
memory/3992-9-0x000002394B2D0000-0x000002394B36E000-memory.dmp
memory/3992-10-0x00000239321F0000-0x0000023932200000-memory.dmp
memory/3992-11-0x000002394C3D0000-0x000002394C3E4000-memory.dmp
memory/3992-20-0x00007FF78C410000-0x00007FF78C436000-memory.dmp
memory/3992-21-0x00000239321F0000-0x0000023932200000-memory.dmp
memory/3992-22-0x00000239321F0000-0x0000023932200000-memory.dmp
memory/3992-23-0x00000239321F0000-0x0000023932200000-memory.dmp
memory/3992-24-0x00000239321F0000-0x0000023932200000-memory.dmp