azorult | 1ca8a6eb97e3bdc6632c0f4263c759a2a2b0b65c765bdb57437312f509452ce7

Analysis

max time kernel
122s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 04:33

Target

f98399c21666ab44ffe10da4e3326546_JaffaCakes118.exe
Size

353KB
MD5

f98399c21666ab44ffe10da4e3326546
SHA1

9aab0059b86f437c987e437dfec661ecf7fa22e6
SHA256

1ca8a6eb97e3bdc6632c0f4263c759a2a2b0b65c765bdb57437312f509452ce7
SHA512

74f550d180b51df18478d2f70be43fda4f13f1e820ab4d560f9e669b505e29354e4f75762de4959a6446cc82e4b2a01600a5010e9ada8727d0a86248a4695145
SSDEEP

6144:RqFQsTyzSawiMDgvm41cN9gL+cD815ua33Gk3DY:GnTyQ5E1cXXTua33BD

Score

10^/10

Family

azorult

http://37.0.10.99/PL341/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/928-0-0x0000000000060000-0x00000000000BE000-memory.dmp	family_zgrat_v1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 928 set thread context of 2604	928	f98399c21666ab44ffe10da4e3326546_JaffaCakes118.exe	29

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 2604	928	f98399c21666ab44ffe10da4e3326546_JaffaCakes118.exe	29
PID 928 wrote to memory of 2604	928	f98399c21666ab44ffe10da4e3326546_JaffaCakes118.exe	29
PID 928 wrote to memory of 2604	928	f98399c21666ab44ffe10da4e3326546_JaffaCakes118.exe	29
PID 928 wrote to memory of 2604	928	f98399c21666ab44ffe10da4e3326546_JaffaCakes118.exe	29
PID 928 wrote to memory of 2604	928	f98399c21666ab44ffe10da4e3326546_JaffaCakes118.exe	29
PID 928 wrote to memory of 2604	928	f98399c21666ab44ffe10da4e3326546_JaffaCakes118.exe	29
PID 928 wrote to memory of 2604	928	f98399c21666ab44ffe10da4e3326546_JaffaCakes118.exe	29
PID 928 wrote to memory of 2604	928	f98399c21666ab44ffe10da4e3326546_JaffaCakes118.exe	29
PID 928 wrote to memory of 2604	928	f98399c21666ab44ffe10da4e3326546_JaffaCakes118.exe	29
PID 928 wrote to memory of 2604	928	f98399c21666ab44ffe10da4e3326546_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\f98399c21666ab44ffe10da4e3326546_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f98399c21666ab44ffe10da4e3326546_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compILer.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compILer.exe"
  2⤵
  PID:2604

memory/928-0-0x0000000000060000-0x00000000000BE000-memory.dmp

Filesize
376KB

Download
memory/928-1-0x0000000074440000-0x0000000074B2E000-memory.dmp

Filesize
6.9MB

Download
memory/928-2-0x0000000074440000-0x0000000074B2E000-memory.dmp

Filesize
6.9MB

Download
memory/928-14-0x0000000074440000-0x0000000074B2E000-memory.dmp

Filesize
6.9MB

Download
memory/2604-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2604-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2604-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2604-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2604-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2604-12-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2604-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2604-15-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2604-16-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2604-17-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2604-18-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download