azorult | 9d8a5043fa9d06d893f188d717685933090030ef69c251e5874486e6459fbff1

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-05-2024 22:16

Target

14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe
Size

623KB
MD5

14b86afcae446dd05cd112c86f9ea918
SHA1

b34d85563bfba95eb90e293a37e892f307cc20cc
SHA256

9d8a5043fa9d06d893f188d717685933090030ef69c251e5874486e6459fbff1
SHA512

f5f6e7967afc0636f658b27349cb0c3ffb4e1a39454a918d19eb25a83d1b328e062087adbbac418fbbccef3130145b2b6721d0fabf43c8a09f0aedb68b8c1e0a
SSDEEP

12288:AzP/ucuMabywtgcidcVktt/phb4duTXuR/u5dRRQ/F:Q/Ybyfpcittpx4duTuxuL6F

Score

10^/10

Family

azorult

http://mcgua.com.ua/au/gate.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1928 set thread context of 1612	1928	14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe	28

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1612	1928	14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe	28
PID 1928 wrote to memory of 1612	1928	14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe	28
PID 1928 wrote to memory of 1612	1928	14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe	28
PID 1928 wrote to memory of 1612	1928	14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe	28
PID 1928 wrote to memory of 1612	1928	14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe	28
PID 1928 wrote to memory of 1612	1928	14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe	28
PID 1928 wrote to memory of 1612	1928	14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe	28
PID 1928 wrote to memory of 1612	1928	14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe	28
PID 1928 wrote to memory of 1612	1928	14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe	28
PID 1928 wrote to memory of 1612	1928	14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe	28
PID 1928 wrote to memory of 1612	1928	14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe	28
PID 1928 wrote to memory of 1612	1928	14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Users\Admin\AppData\Local\Temp\14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe"
  2⤵
  PID:1612

memory/1612-3-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1612-7-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1612-5-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1612-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1612-8-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1928-6-0x00000000005E0000-0x00000000006E0000-memory.dmp

Filesize
1024KB

Download