azorult | 463f4cf2c603f208253b7422335775d22934a251a84e684374cee6c1be6c626b

Analysis

max time kernel
133s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2024 22:01

Target

14a96e2b320db6d5e89fd68377c206c2_JaffaCakes118.exe
Size

136KB
MD5

14a96e2b320db6d5e89fd68377c206c2
SHA1

c720d00d79d7c1a0f34eb881b1c456ce71b73c0d
SHA256

463f4cf2c603f208253b7422335775d22934a251a84e684374cee6c1be6c626b
SHA512

a7cfe2bd35999ad2638b4a9be20ccef58db38178526fb713fba0a94d8ebd98e6c90ce6e040e2159c861537f381da50bb8a0f6563b37a608fb4e925d8ebe3a7d2
SSDEEP

3072:FGETFmh2/ST+KwgH8eMJuXDBFYTycga1CdvKssTeTB1inQiFIS9:FGMmhoSTPwbe9DBqcaAqDQiFP9

Score

10^/10

Family

azorult

http://51.15.62.59/AED77D05-A028-477C-B013-04F33F1385C3/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4000-0-0x0000000000400000-0x0000000000451000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4680 4000 WerFault.exe 14a96e2b320db6d5e89fd68377c206c2_JaffaCakes118.exe

pid	pid_target	process	target process
4680	4000	WerFault.exe	14a96e2b320db6d5e89fd68377c206c2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\14a96e2b320db6d5e89fd68377c206c2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\14a96e2b320db6d5e89fd68377c206c2_JaffaCakes118.exe"
1⤵
PID:4000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 1256
2⤵
- Program crash
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4000 -ip 4000
1⤵
PID:4904

memory/4000-0-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/4000-2-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/4000-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4000-4-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/4000-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download