azorult | 06d5ea0f1d275963db09cd90ba5c7e0790bb52a4da343250acddbebab29a96bb

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02-05-2024 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e058b28ee7d0973bef985ec9a06a4cb_JaffaCakes118.exe
Size

1.7MB
MD5

0e058b28ee7d0973bef985ec9a06a4cb
SHA1

422c3807fe34196d35ab45c7ae0ea6cd1640c6ca
SHA256

06d5ea0f1d275963db09cd90ba5c7e0790bb52a4da343250acddbebab29a96bb
SHA512

e43f7daf9e52c5c4214ec789faff4811bcac57371d8b5da708a1878ffae7413d9855b851fe112d5c67592c178a3c90ccb181f100972e21d901939780d70145ae
SSDEEP

24576:boQeYzZwfvCyz63zzrDnzQT3wtnMCzmEMI4Wip:Xe0wfvD

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://bzlogi.tk/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3024 set thread context of 2548	3024	0e058b28ee7d0973bef985ec9a06a4cb_JaffaCakes118.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3024	0e058b28ee7d0973bef985ec9a06a4cb_JaffaCakes118.exe
3024	0e058b28ee7d0973bef985ec9a06a4cb_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3024	0e058b28ee7d0973bef985ec9a06a4cb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2548	3024	0e058b28ee7d0973bef985ec9a06a4cb_JaffaCakes118.exe	29
PID 3024 wrote to memory of 2548	3024	0e058b28ee7d0973bef985ec9a06a4cb_JaffaCakes118.exe	29
PID 3024 wrote to memory of 2548	3024	0e058b28ee7d0973bef985ec9a06a4cb_JaffaCakes118.exe	29
PID 3024 wrote to memory of 2548	3024	0e058b28ee7d0973bef985ec9a06a4cb_JaffaCakes118.exe	29
PID 3024 wrote to memory of 2548	3024	0e058b28ee7d0973bef985ec9a06a4cb_JaffaCakes118.exe	29
PID 3024 wrote to memory of 2548	3024	0e058b28ee7d0973bef985ec9a06a4cb_JaffaCakes118.exe	29
PID 3024 wrote to memory of 2548	3024	0e058b28ee7d0973bef985ec9a06a4cb_JaffaCakes118.exe	29
PID 3024 wrote to memory of 2548	3024	0e058b28ee7d0973bef985ec9a06a4cb_JaffaCakes118.exe	29
PID 3024 wrote to memory of 2548	3024	0e058b28ee7d0973bef985ec9a06a4cb_JaffaCakes118.exe	29
PID 3024 wrote to memory of 2548	3024	0e058b28ee7d0973bef985ec9a06a4cb_JaffaCakes118.exe	29
PID 3024 wrote to memory of 2548	3024	0e058b28ee7d0973bef985ec9a06a4cb_JaffaCakes118.exe	29
PID 3024 wrote to memory of 2548	3024	0e058b28ee7d0973bef985ec9a06a4cb_JaffaCakes118.exe	29
PID 3024 wrote to memory of 2548	3024	0e058b28ee7d0973bef985ec9a06a4cb_JaffaCakes118.exe	29
PID 3024 wrote to memory of 2548	3024	0e058b28ee7d0973bef985ec9a06a4cb_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\0e058b28ee7d0973bef985ec9a06a4cb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0e058b28ee7d0973bef985ec9a06a4cb_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2548-19-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2548-17-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2548-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2548-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2548-13-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2548-15-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2548-21-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2548-22-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2548-24-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3024-2-0x00000000004F0000-0x0000000000508000-memory.dmp

Filesize
96KB

Download
memory/3024-7-0x0000000074BF0000-0x00000000752DE000-memory.dmp

Filesize
6.9MB

Download
memory/3024-6-0x0000000074BF0000-0x00000000752DE000-memory.dmp

Filesize
6.9MB

Download
memory/3024-0-0x0000000074BFE000-0x0000000074BFF000-memory.dmp

Filesize
4KB

Download
memory/3024-1-0x0000000000F40000-0x00000000010EC000-memory.dmp

Filesize
1.7MB

Download
memory/3024-5-0x0000000074BF0000-0x00000000752DE000-memory.dmp

Filesize
6.9MB

Download
memory/3024-4-0x0000000074BFE000-0x0000000074BFF000-memory.dmp

Filesize
4KB

Download
memory/3024-11-0x0000000074BF0000-0x00000000752DE000-memory.dmp

Filesize
6.9MB

Download
memory/3024-23-0x0000000074BF0000-0x00000000752DE000-memory.dmp

Filesize
6.9MB

Download
memory/3024-3-0x0000000074BF0000-0x00000000752DE000-memory.dmp

Filesize
6.9MB

Download