azorult | ce9a7a5c2deb38b38c48a680f2f4ef3cc2f0e9a45248b79bb8a7065578662d79

Analysis

max time kernel
131s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/05/2024, 11:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c355ce816f4020a650a0db53b2d8d57_JaffaCakes118.exe
Size

1.0MB
MD5

1c355ce816f4020a650a0db53b2d8d57
SHA1

2bbfdc36ef5c7373c33fa8f2a678a40da1de15b9
SHA256

ce9a7a5c2deb38b38c48a680f2f4ef3cc2f0e9a45248b79bb8a7065578662d79
SHA512

f182e7dc74ad314efacb3c8a216a10ffa9dee1c1bc15cdfbb535af773db1b1ec5ea1c6bd388fce5cd6e79b463b6408411576cf47c78fe7164b33959adcb28ba0
SSDEEP

24576:aAHnh+eWsN3skA4RV1Hom2KXMmHaH1cbUM3O10j5:th+ZkldoPK8YaH1cQj0

Score

10^/10

azorult infostealer trojan upx

Malware Config

Extracted

Family

azorult

http://kinotoday.ug/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Executes dropped EXE 6 IoCs

pid	Process
2568	AU3_EXE-3_2019-02-04_21-18.exe
2556	N2anoSim.exe
1964	WindowsLauncher.exe
944	WindowsLauncher.exe
676	WindowsLauncher.exe
1844	WindowsLauncher.exe

Loads dropped DLL 8 IoCs

pid	Process
1340	1c355ce816f4020a650a0db53b2d8d57_JaffaCakes118.exe
1340	1c355ce816f4020a650a0db53b2d8d57_JaffaCakes118.exe
1340	1c355ce816f4020a650a0db53b2d8d57_JaffaCakes118.exe
1340	1c355ce816f4020a650a0db53b2d8d57_JaffaCakes118.exe
1340	1c355ce816f4020a650a0db53b2d8d57_JaffaCakes118.exe
1340	1c355ce816f4020a650a0db53b2d8d57_JaffaCakes118.exe
1340	1c355ce816f4020a650a0db53b2d8d57_JaffaCakes118.exe
1340	1c355ce816f4020a650a0db53b2d8d57_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000015a2d-5.dat	upx
behavioral1/memory/2568-27-0x0000000000400000-0x0000000000453000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2556	N2anoSim.exe
1964	WindowsLauncher.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe
Token: SeSecurityPrivilege	2568	AU3_EXE-3_2019-02-04_21-18.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 2568	1340	1c355ce816f4020a650a0db53b2d8d57_JaffaCakes118.exe	28
PID 1340 wrote to memory of 2568	1340	1c355ce816f4020a650a0db53b2d8d57_JaffaCakes118.exe	28
PID 1340 wrote to memory of 2568	1340	1c355ce816f4020a650a0db53b2d8d57_JaffaCakes118.exe	28
PID 1340 wrote to memory of 2568	1340	1c355ce816f4020a650a0db53b2d8d57_JaffaCakes118.exe	28
PID 1340 wrote to memory of 2556	1340	1c355ce816f4020a650a0db53b2d8d57_JaffaCakes118.exe	29
PID 1340 wrote to memory of 2556	1340	1c355ce816f4020a650a0db53b2d8d57_JaffaCakes118.exe	29
PID 1340 wrote to memory of 2556	1340	1c355ce816f4020a650a0db53b2d8d57_JaffaCakes118.exe	29
PID 1340 wrote to memory of 2556	1340	1c355ce816f4020a650a0db53b2d8d57_JaffaCakes118.exe	29
PID 2556 wrote to memory of 636	2556	N2anoSim.exe	31
PID 2556 wrote to memory of 636	2556	N2anoSim.exe	31
PID 2556 wrote to memory of 636	2556	N2anoSim.exe	31
PID 2556 wrote to memory of 1964	2556	N2anoSim.exe	33
PID 2556 wrote to memory of 1964	2556	N2anoSim.exe	33
PID 2556 wrote to memory of 1964	2556	N2anoSim.exe	33
PID 636 wrote to memory of 2780	636	cmd.exe	34
PID 636 wrote to memory of 2780	636	cmd.exe	34
PID 636 wrote to memory of 2780	636	cmd.exe	34
PID 2556 wrote to memory of 2800	2556	N2anoSim.exe	35
PID 2556 wrote to memory of 2800	2556	N2anoSim.exe	35
PID 2556 wrote to memory of 2800	2556	N2anoSim.exe	35
PID 2800 wrote to memory of 2940	2800	cmd.exe	37
PID 2800 wrote to memory of 2940	2800	cmd.exe	37
PID 2800 wrote to memory of 2940	2800	cmd.exe	37
PID 1992 wrote to memory of 944	1992	taskeng.exe	39
PID 1992 wrote to memory of 944	1992	taskeng.exe	39
PID 1992 wrote to memory of 944	1992	taskeng.exe	39
PID 1992 wrote to memory of 676	1992	taskeng.exe	42
PID 1992 wrote to memory of 676	1992	taskeng.exe	42
PID 1992 wrote to memory of 676	1992	taskeng.exe	42
PID 1992 wrote to memory of 1844	1992	taskeng.exe	43
PID 1992 wrote to memory of 1844	1992	taskeng.exe	43
PID 1992 wrote to memory of 1844	1992	taskeng.exe	43

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1c355ce816f4020a650a0db53b2d8d57_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1c355ce816f4020a650a0db53b2d8d57_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Users\Admin\AppData\Roaming\Z1082326219\AU3_EXE-3_2019-02-04_21-18.exe
  "C:\Users\Admin\AppData\Roaming\Z1082326219\AU3_EXE-3_2019-02-04_21-18.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2568
- C:\Users\Admin\AppData\Roaming\Z1082326219\N2anoSim.exe
  "C:\Users\Admin\AppData\Roaming\Z1082326219\N2anoSim.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\system32\cmd.exe
    "cmd.exe" /C schtasks /create /tn \Defaults\AzureSDKService_Admin /tr "C:\Users\Admin\AppData\Local\Temp\NetPlatform\WindowsLauncher.exe" /st 11:09 /du 9999:59 /sc daily /ri 1 /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:636
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn \Defaults\AzureSDKService_Admin /tr "C:\Users\Admin\AppData\Local\Temp\NetPlatform\WindowsLauncher.exe" /st 11:09 /du 9999:59 /sc daily /ri 1 /f
      4⤵
      Creates scheduled task(s)
      PID:2780
- - C:\Users\Admin\AppData\Local\Temp\NetPlatform\WindowsLauncher.exe
    "C:\Users\Admin\AppData\Local\Temp\NetPlatform\WindowsLauncher.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1964
- - C:\Windows\system32\cmd.exe
    "cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Z1082326219\N2anoSim.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2800
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2940

C:\Windows\system32\taskeng.exe
taskeng.exe {40164BE8-EB3D-478B-A44D-3870B2EC65A8} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\NetPlatform\WindowsLauncher.exe
  C:\Users\Admin\AppData\Local\Temp\NetPlatform\WindowsLauncher.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Users\Admin\AppData\Local\Temp\NetPlatform\WindowsLauncher.exe
  C:\Users\Admin\AppData\Local\Temp\NetPlatform\WindowsLauncher.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Users\Admin\AppData\Local\Temp\NetPlatform\WindowsLauncher.exe
  C:\Users\Admin\AppData\Local\Temp\NetPlatform\WindowsLauncher.exe
  2⤵
  - Executes dropped EXE
  PID:1844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Costura\191AC1E27489ED93F3D58AB38CD9BE63\costura.dll

Filesize
4KB

MD5
53fcb5e5c897094cf6780679e61ec6f1

SHA1
59feb2af0be9ec4ccec2125d2383e3e282f428a7

SHA256
63e40fbde384f1b95e4f887948fb637b0d52cef4f13b8270d3e3a940d6861746

SHA512
819fecb5ae2433e4b0be00d38c2ff73a2a241d96d196c8fb844245b8ee9fbfa46595aa79db8e68c01d1150e9ef3a72e49d07a30fc730e3c4410a98f93f900532

Download Submit
C:\Users\Admin\AppData\Local\Temp\Costura\191AC1E27489ED93F3D58AB38CD9BE63\datalaunch.dll

Filesize
15KB

MD5
c5aa133f6fee56ff23b2c4210a672ce6

SHA1
02baf5243c9b879e21725708edf2923c24e781a4

SHA256
c04f67c241529abd6dd18f20ffe756a7cbaf450d131e194c15dcd9a6c1155aa8

SHA512
a6fd5132282de0dbf37ad0db0d0d7d2b33606b58830492f5e31092293d0dfaaeea0f83494c3fa3603a58ca64c4b5967bcb2828c10ee1b8a5ae059051349320a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Costura\191AC1E27489ED93F3D58AB38CD9BE63\datalaunch.pdb

Filesize
27KB

MD5
71908b86debe0e353a6fa258feb12606

SHA1
3ef0f26741fde5637fe97c7320e2bc46d63907a2

SHA256
4825959af1d56f5ec08f5fc31fb000a7ff07f0832f7dceb03e3082847e0f00ff

SHA512
b75591a4d17b1d0ff3f7e906dc4e20561d34861a1052e2228deb6f12b0a4d8a01467037a240742bacfd52090e69f55546b8e94e01111d7b235bd30d7f5ca4da6

Download Submit
C:\Users\Admin\AppData\Roaming\Z1082326219\AU3_EXE-3_2019-02-04_21-18.exe

Filesize
153KB

MD5
a471f6259272c735fba657e420f67f15

SHA1
5e0afdbf4b329b3a09f9668866b4900a06211013

SHA256
dfbfad578c25d04750ce1e5a72006d25408f9a3a833b047ab6bf2afef2dc3728

SHA512
ab43e77b3d3c77ae28dc810e9dadcd63e407cc26d78b61c973accf9e7bc02b457c04f8d25cb4742bd9bb3488c0e662d1c3e8c3bf3bbb930fb8a039e3c47b5a0f

Download Submit
\Users\Admin\AppData\Roaming\Z1082326219\N2anoSim.exe

Filesize
138KB

MD5
9c54a04bdb65eb552bc0f5ce3cf8ef4f

SHA1
7864788d533be44a2ea7c4884ebea1b33efd5acd

SHA256
acd9d212f62c163a10466709ceeb55ad8cc13d3163423ce755770e1950568761

SHA512
e65ddd48fca5233f722c554491edde105e587da0fac79ee03e107b5f97410e836411f70902c5a6bba71b0b6eae6fba8a05ab30fe888510694526cd64481544b4

Download Submit
memory/1340-13-0x00000000029D0000-0x0000000002A23000-memory.dmp

Filesize
332KB

Download
memory/1340-14-0x00000000029D0000-0x0000000002A23000-memory.dmp

Filesize
332KB

Download
memory/1964-61-0x00000000013D0000-0x00000000013F8000-memory.dmp

Filesize
160KB

Download
memory/2556-42-0x0000000000970000-0x0000000000998000-memory.dmp

Filesize
160KB

Download
memory/2556-53-0x000007FEF5780000-0x000007FEF616C000-memory.dmp

Filesize
9.9MB

Download
memory/2556-50-0x0000000000900000-0x000000000090A000-memory.dmp

Filesize
40KB

Download
memory/2556-41-0x000007FEF5783000-0x000007FEF5784000-memory.dmp

Filesize
4KB

Download
memory/2556-65-0x000007FEF5780000-0x000007FEF616C000-memory.dmp

Filesize
9.9MB

Download
memory/2568-55-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2568-54-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2568-27-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2568-67-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2568-68-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download