azorult | 9d8a5043fa9d06d893f188d717685933090030ef69c251e5874486e6459fbff1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2024 22:16

Target

14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe
Size

623KB
MD5

14b86afcae446dd05cd112c86f9ea918
SHA1

b34d85563bfba95eb90e293a37e892f307cc20cc
SHA256

9d8a5043fa9d06d893f188d717685933090030ef69c251e5874486e6459fbff1
SHA512

f5f6e7967afc0636f658b27349cb0c3ffb4e1a39454a918d19eb25a83d1b328e062087adbbac418fbbccef3130145b2b6721d0fabf43c8a09f0aedb68b8c1e0a
SSDEEP

12288:AzP/ucuMabywtgcidcVktt/phb4duTXuR/u5dRRQ/F:Q/Ybyfpcittpx4duTuxuL6F

Score

10^/10

Family

azorult

http://mcgua.com.ua/au/gate.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1396 set thread context of 4512	1396	14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe	85

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 4512	1396	14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe	85
PID 1396 wrote to memory of 4512	1396	14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe	85
PID 1396 wrote to memory of 4512	1396	14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe	85
PID 1396 wrote to memory of 4512	1396	14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe	85
PID 1396 wrote to memory of 4512	1396	14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe	85
PID 1396 wrote to memory of 4512	1396	14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe	85
PID 1396 wrote to memory of 4512	1396	14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe	85
PID 1396 wrote to memory of 4512	1396	14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe	85
PID 1396 wrote to memory of 4512	1396	14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe	85
PID 1396 wrote to memory of 4512	1396	14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe	85
PID 1396 wrote to memory of 4512	1396	14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Users\Admin\AppData\Local\Temp\14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\14b86afcae446dd05cd112c86f9ea918_JaffaCakes118.exe"
  2⤵
  PID:4512

memory/1396-4-0x0000000000680000-0x0000000000780000-memory.dmp

Filesize
1024KB

Download
memory/4512-1-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4512-3-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4512-5-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4512-6-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download