azorult | 27c92fe6c131c4f41f6d524837ba073f396130658c51108f94cb514b7f571dc4

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-04-2024 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe
Size

283KB
MD5

c62b0f6c44abf03c26dab89826464f74
SHA1

9ca8c875e687baa367a35873a85c9916cf3a4c2b
SHA256

27c92fe6c131c4f41f6d524837ba073f396130658c51108f94cb514b7f571dc4
SHA512

d0b8272134709b5aa04712f04f7f1bf02fca9e377e80ee1956b8134df0197fe7d4e94287146e47a828c89fc201dbb4679b87896153f93261d1a5741c56140a62
SSDEEP

6144:PBlL/IkB3YxRxiY0FXe0M6t2BrlkKxXR9vYsfE:pSkB3YxRxMFXY/llR9A1

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://21slg.xyz/PL341/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Loads dropped DLL 1 IoCs

pid	Process
2368	c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2656	2512	WerFault.exe	28

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2512	2368	c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe	28
PID 2368 wrote to memory of 2512	2368	c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe	28
PID 2368 wrote to memory of 2512	2368	c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe	28
PID 2368 wrote to memory of 2512	2368	c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe	28
PID 2368 wrote to memory of 2512	2368	c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe	28
PID 2368 wrote to memory of 2512	2368	c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe	28
PID 2368 wrote to memory of 2512	2368	c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe	28
PID 2368 wrote to memory of 2512	2368	c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe	28
PID 2368 wrote to memory of 2512	2368	c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe	28
PID 2368 wrote to memory of 2512	2368	c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe	28
PID 2368 wrote to memory of 2512	2368	c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe	28
PID 2512 wrote to memory of 2656	2512	c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe	29
PID 2512 wrote to memory of 2656	2512	c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe	29
PID 2512 wrote to memory of 2656	2512	c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe	29
PID 2512 wrote to memory of 2656	2512	c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 120
    3⤵
    - Program crash
    PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsd4F78.tmp\lyinn.dll

Filesize
26KB

MD5
b7f9a167c3af210c5a0be8393b9f04e2

SHA1
8e540308abf226139bf08c61fa21598c0eb055da

SHA256
fd6451ef4e817f604a14be5ab85b5e9890a276ba877d38a9b9544c41ed4718a7

SHA512
75a44e8939f23fa143b67fbd664b81758c0718343e7cb3836b5651bd87e0533d03973b34cbb7b03b50a1fb3828fb0ddf93b205f42e0c8198bfb575088dc9b128

Download Submit
memory/2368-8-0x0000000074820000-0x000000007482A000-memory.dmp

Filesize
40KB

Download
memory/2368-12-0x0000000074820000-0x000000007482A000-memory.dmp

Filesize
40KB

Download
memory/2512-9-0x00000000001C0000-0x00000000001E0000-memory.dmp

Filesize
128KB

Download
memory/2512-13-0x00000000001C0000-0x00000000001E0000-memory.dmp

Filesize
128KB

Download
memory/2512-16-0x00000000001C0000-0x00000000001E0000-memory.dmp

Filesize
128KB

Download