azorult | 8d19e61c0ad1199769a311aac2434dc684b32b3a7781c01eeecff12fff6eadfd

General

Target

126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe
Size

1.0MB
MD5

126dc3cb3bb98900e909476b955e192d
SHA1

1690010021fb25ffbb3c30f108b0c6bf00a6bb03
SHA256

8d19e61c0ad1199769a311aac2434dc684b32b3a7781c01eeecff12fff6eadfd
SHA512

d232bd9ec17f31954af540ea5df87fac78658b0b3e843ecccaa871d6f79bded1ef9e3aa69ac90052682bcfebe0266ab0fd5f3afb99cb41ef02b7c07bf6038fec
SSDEEP

24576:jF6yDgwTwbRZ8NfjTC8YnvovoP5PIUmkpk8czQB:jF6l6sv/KNS

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://5.101.78.169/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe

description	pid	process	target process
PID 3708 set thread context of 2688	3708	126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe	126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe

description	pid	process	target process
PID 3708 wrote to memory of 2688	3708	126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe	126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe
PID 3708 wrote to memory of 2688	3708	126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe	126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe
PID 3708 wrote to memory of 2688	3708	126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe	126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe
PID 3708 wrote to memory of 2688	3708	126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe	126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe
PID 3708 wrote to memory of 2688	3708	126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe	126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe
PID 3708 wrote to memory of 2688	3708	126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe	126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe
PID 3708 wrote to memory of 2688	3708	126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe	126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe
PID 3708 wrote to memory of 2688	3708	126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe	126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe
PID 3708 wrote to memory of 2688	3708	126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe	126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe
PID 3708 wrote to memory of 2688	3708	126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe	126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3708

C:\Users\Admin\AppData\Local\Temp\126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe"
2⤵
PID:2688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2688-61-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2688-63-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2688-64-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2688-66-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3708-0-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/3708-1-0x0000000002180000-0x00000000021DF000-memory.dmp

Filesize
380KB

Download
memory/3708-5-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/3708-9-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/3708-8-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/3708-6-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/3708-4-0x0000000002120000-0x0000000002121000-memory.dmp

Filesize
4KB

Download
memory/3708-3-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/3708-7-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/3708-2-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/3708-14-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/3708-49-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/3708-48-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/3708-47-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/3708-46-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/3708-45-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/3708-44-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/3708-43-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/3708-42-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/3708-41-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/3708-40-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/3708-39-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/3708-38-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/3708-37-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/3708-50-0x0000000003360000-0x0000000003362000-memory.dmp

Filesize
8KB

Download
memory/3708-36-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/3708-35-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/3708-34-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/3708-33-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/3708-32-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/3708-31-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/3708-30-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/3708-29-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/3708-28-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/3708-27-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/3708-26-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/3708-25-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/3708-24-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/3708-23-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/3708-22-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/3708-21-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/3708-20-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/3708-19-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/3708-18-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/3708-17-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/3708-16-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/3708-15-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/3708-13-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/3708-12-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/3708-11-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/3708-10-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/3708-51-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/3708-52-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/3708-53-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/3708-54-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/3708-56-0x0000000002180000-0x00000000021DF000-memory.dmp

Filesize
380KB

Download
memory/3708-57-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/3708-62-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing