Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
31/10/2026, 00:16
General
- Target setup.exe
- Size 93KB
- Sample261031-aky2dstt6l
- SHA256 52e7f3cf0136b25a44525c41d482a6d12060baa2c5ad615fd8e21c310c20146d
Malware Config
Extracted
-
azalea
-
it
-
198.19.248.16:8080
-
UpdateOrchestratore3a8
-
xEbpdVpGMv3CnnKbLuSFmviqRV
-
EgkPRvdXmtxfZYaKeLasR8xnUbH3WmP8ZA3f
-
amsi_patch
true
-
av_exclusion_path
C:\Windows\Temp
-
beacon_interval_seconds
57
-
beacon_path
/api/telemetry
-
install
true
-
install_path
%UserProfile%\AppData\Roaming\qpaamv8\MicrosoftEdgeUpdate.exe
-
persistent_queue_path
%Temp%\ossqhn.dat
-
registry_key
SecurityHealthSystray
-
scheduled_task
MicrosoftEdgeUpdateTaskCore
-
uac_bypass
true
-
user_agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Signatures
- Family: Azalea
Azalea is a modular Windows RAT written in C#.
- Detects Azalea RAT 1 IoCs
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 51 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/924-0-0x000001E2E3780000-0x000001E2E3792000-memory.dmp
memory/924-1-0x000001E2E5010000-0x000001E2E502D000-memory.dmp
memory/924-2-0x00007FFE9F5D0000-0x00007FFE9F5D1000-memory.dmp
memory/924-7-0x000001E2FF9A0000-0x000001E2FFB82000-memory.dmp
memory/924-9-0x000001E2FF860000-0x000001E2FF8FE000-memory.dmp
memory/924-8-0x000001E2FF7B0000-0x000001E2FF858000-memory.dmp
memory/924-6-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/924-5-0x00007FFE7C94F000-0x00007FFE7C950000-memory.dmp
memory/924-10-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/924-11-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/924-12-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/924-13-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/924-14-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/924-15-0x000001E280000000-0x000001E280015000-memory.dmp
memory/924-24-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/924-25-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/924-26-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/924-28-0x00007FF77E230000-0x00007FF77E256000-memory.dmp
memory/924-27-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/924-29-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/924-30-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/924-31-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/924-32-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/924-34-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/924-35-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/924-36-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/924-37-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp