azorult | 6bfa9afe00817e0bb095857b29aa5d9b6cff24a3a00d8f6f2ecdb46044166e6d

General

Target

2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe
Size

510KB
MD5

2a61ed646b3bc1ffc6a186936ea38f37
SHA1

cff639c2770fa6fe53095f2c4571088001481bf0
SHA256

6bfa9afe00817e0bb095857b29aa5d9b6cff24a3a00d8f6f2ecdb46044166e6d
SHA512

bfe8d71ebeab8227c3ccc21c567ddb90b1d73dd6834110c496ae70cec410c435689bdea79672d1e874ae4cf7fe0888a6aa35214c0c4f3fd873ec325b046bb61a
SSDEEP

6144:mpVFXXnEkkzFkldxNDEKu0jExGwoMwrni/Y4Yv1MHCR+5K7/J3bVuRpIIQ+:0FnnEkkZkjxluyTFr12To7B3oIIQ+

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://185.79.156.23/jg/6/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Drops startup file 1 IoCs

Processes:

2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ivpkngmkuummupt.eu.url	2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe

description	pid	process	target process
PID 4568 set thread context of 2860	4568	2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe	2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe

pid	process
4568	2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe
4568	2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe
4568	2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe
4568	2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe
4568	2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe
4568	2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe
4568	2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe
4568	2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe
4568	2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe
4568	2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe
4568	2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe
4568	2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe
4568	2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe
4568	2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe

pid process

4568 2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe

description	pid	process	target process
PID 4568 wrote to memory of 2860	4568	2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe	2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe
PID 4568 wrote to memory of 2860	4568	2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe	2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe
PID 4568 wrote to memory of 2860	4568	2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe	2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe
PID 4568 wrote to memory of 2860	4568	2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe	2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4568

C:\Users\Admin\AppData\Local\Temp\2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118.exe"
2⤵
PID:2860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2860-32-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2860-33-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4568-14-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-26-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-13-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-25-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-24-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-23-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-22-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-21-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-20-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-19-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-18-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-17-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-16-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-15-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-29-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-27-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-12-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-11-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-10-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-9-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-8-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-7-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-6-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-5-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-4-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-3-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-2-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-1-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-28-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4568-0-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads