Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
31/10/2026, 00:18
General
- Target setup.exe
- Size 93KB
- Sample261031-alyf9af12y
- SHA256 52e7f3cf0136b25a44525c41d482a6d12060baa2c5ad615fd8e21c310c20146d
Malware Config
Extracted
-
azalea
-
it
-
198.19.248.16:8080
-
UpdateOrchestratore3a8
-
xEbpdVpGMv3CnnKbLuSFmviqRV
-
EgkPRvdXmtxfZYaKeLasR8xnUbH3WmP8ZA3f
-
amsi_patch
true
-
av_exclusion_path
C:\Windows\Temp
-
beacon_interval_seconds
57
-
beacon_path
/api/telemetry
-
install
true
-
install_path
%UserProfile%\AppData\Roaming\qpaamv8\MicrosoftEdgeUpdate.exe
-
persistent_queue_path
%Temp%\ossqhn.dat
-
registry_key
SecurityHealthSystray
-
scheduled_task
MicrosoftEdgeUpdateTaskCore
-
uac_bypass
true
-
user_agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Signatures
- Family: Azalea
Azalea is a modular Windows RAT written in C#.
- Detects Azalea RAT 1 IoCs
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 51 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3656-0-0x000002611B640000-0x000002611B652000-memory.dmp
memory/3656-1-0x000002611D0D0000-0x000002611D0ED000-memory.dmp
memory/3656-2-0x00007FF99C1F0000-0x00007FF99C1F1000-memory.dmp
memory/3656-5-0x000002611E4BC000-0x000002611E4BD000-memory.dmp
memory/3656-6-0x0000026138540000-0x0000026138722000-memory.dmp
memory/3656-7-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-8-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-10-0x00000261382A0000-0x000002613833E000-memory.dmp
memory/3656-9-0x0000026138170000-0x0000026138218000-memory.dmp
memory/3656-11-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-12-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-13-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-14-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-15-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-16-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-25-0x0000026138AF0000-0x0000026138B05000-memory.dmp
memory/3656-26-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-27-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-28-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-29-0x00007FF7F2650000-0x00007FF7F2676000-memory.dmp
memory/3656-31-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-32-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-33-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-35-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-36-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-37-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-38-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-39-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-41-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-43-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-45-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-47-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-49-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-51-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-53-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-55-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-57-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-59-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-61-0x000002611DD20000-0x000002611E6C4000-memory.dmp
memory/3656-63-0x000002611DD20000-0x000002611E6C4000-memory.dmp