azorult | be8bbdc35051ed7a5a6559015576925da47d1c95484f43fd817c6fc8ac22870d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2024 03:44

Target

1a9adb7d7296a32bf60c18c9a061b8e4_JaffaCakes118.exe
Size

263KB
MD5

1a9adb7d7296a32bf60c18c9a061b8e4
SHA1

62fa996108c89c4c306e0a6f6b1186235799b219
SHA256

be8bbdc35051ed7a5a6559015576925da47d1c95484f43fd817c6fc8ac22870d
SHA512

5e64ee677813244080ad8d2203a17d3cbc30ceba41dcc82e9c6aaf5e225d5f5beb8bf3781cf6ccb5145482cec7a0e30e9524183565074d038629e342f2006a92
SSDEEP

3072:eCRiNytdviZQezPJyqS1A/R0yBWYraiqBo0foipwZ81wlIE9qFuN:eCRX2QSPJPHmyBUBkipwuFK

Score

10^/10

Family

azorult

http://tuscano.ug/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Program crash 7 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4336	2496	WerFault.exe	1a9adb7d7296a32bf60c18c9a061b8e4_JaffaCakes118.exe
5080	2496	WerFault.exe	1a9adb7d7296a32bf60c18c9a061b8e4_JaffaCakes118.exe
3516	2496	WerFault.exe	1a9adb7d7296a32bf60c18c9a061b8e4_JaffaCakes118.exe
4948	2496	WerFault.exe	1a9adb7d7296a32bf60c18c9a061b8e4_JaffaCakes118.exe
2012	2496	WerFault.exe	1a9adb7d7296a32bf60c18c9a061b8e4_JaffaCakes118.exe
4028	2496	WerFault.exe	1a9adb7d7296a32bf60c18c9a061b8e4_JaffaCakes118.exe
3656	2496	WerFault.exe	1a9adb7d7296a32bf60c18c9a061b8e4_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\1a9adb7d7296a32bf60c18c9a061b8e4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a9adb7d7296a32bf60c18c9a061b8e4_JaffaCakes118.exe"
1⤵
PID:2496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 784
2⤵
- Program crash
PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 792
2⤵
- Program crash
PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 868
2⤵
- Program crash
PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 844
2⤵
- Program crash
PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 952
2⤵
- Program crash
PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 952
2⤵
- Program crash
PID:4028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 1388
2⤵
- Program crash
PID:3656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2496 -ip 2496
1⤵
PID:932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2496 -ip 2496
1⤵
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2496 -ip 2496
1⤵
PID:1464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2496 -ip 2496
1⤵
PID:1824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2496 -ip 2496
1⤵
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2496 -ip 2496
1⤵
PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2496 -ip 2496
1⤵
PID:544

memory/2496-2-0x00000000001D0000-0x00000000001ED000-memory.dmp

Filesize
116KB

Download
memory/2496-1-0x00000000036D0000-0x00000000037D0000-memory.dmp

Filesize
1024KB

Download
memory/2496-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2496-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2496-5-0x00000000001D0000-0x00000000001ED000-memory.dmp

Filesize
116KB

Download
memory/2496-4-0x0000000000400000-0x0000000003597000-memory.dmp

Filesize
49.6MB

Download