azorult | a8e109be069f5ee700269958c9a2312f8417e7e6d88e5cfcdc439865f4a896e0

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 15:53

Target

2ab7f3ea6fc43a1d7ad31ada16ed5102_JaffaCakes118.exe
Size

812KB
MD5

2ab7f3ea6fc43a1d7ad31ada16ed5102
SHA1

a3be9e5ebbf896408dd5e41ed53eca5699ea0562
SHA256

a8e109be069f5ee700269958c9a2312f8417e7e6d88e5cfcdc439865f4a896e0
SHA512

69fb015a01dea813a6877c3829eb506ce61879653e0d93a2705aa497bf8ab03969dce2e6afa19e18f06059567a548ea75633277605627472f2ac7d24e1199682
SSDEEP

12288:7b6mCM9sXHh9BoRPqsxOVKuS5r70xwgeqh043L97/hOYEOJ3e0ZQsMG:KeSHhYRRxOVGcxJBdb1NzkcQsF

Score

10^/10

Family

azorult

http://207.154.240.23/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

2ab7f3ea6fc43a1d7ad31ada16ed5102_JaffaCakes118.exe

description	pid	process	target process
PID 1948 set thread context of 2132	1948	2ab7f3ea6fc43a1d7ad31ada16ed5102_JaffaCakes118.exe	2ab7f3ea6fc43a1d7ad31ada16ed5102_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

2ab7f3ea6fc43a1d7ad31ada16ed5102_JaffaCakes118.exe

pid process

1948 2ab7f3ea6fc43a1d7ad31ada16ed5102_JaffaCakes118.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

2ab7f3ea6fc43a1d7ad31ada16ed5102_JaffaCakes118.exe

pid process

1948 2ab7f3ea6fc43a1d7ad31ada16ed5102_JaffaCakes118.exe

pid	process
1948	2ab7f3ea6fc43a1d7ad31ada16ed5102_JaffaCakes118.exe

pid	process
1948	2ab7f3ea6fc43a1d7ad31ada16ed5102_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2ab7f3ea6fc43a1d7ad31ada16ed5102_JaffaCakes118.exe

description	pid	process	target process
PID 1948 wrote to memory of 2132	1948	2ab7f3ea6fc43a1d7ad31ada16ed5102_JaffaCakes118.exe	2ab7f3ea6fc43a1d7ad31ada16ed5102_JaffaCakes118.exe
PID 1948 wrote to memory of 2132	1948	2ab7f3ea6fc43a1d7ad31ada16ed5102_JaffaCakes118.exe	2ab7f3ea6fc43a1d7ad31ada16ed5102_JaffaCakes118.exe
PID 1948 wrote to memory of 2132	1948	2ab7f3ea6fc43a1d7ad31ada16ed5102_JaffaCakes118.exe	2ab7f3ea6fc43a1d7ad31ada16ed5102_JaffaCakes118.exe
PID 1948 wrote to memory of 2132	1948	2ab7f3ea6fc43a1d7ad31ada16ed5102_JaffaCakes118.exe	2ab7f3ea6fc43a1d7ad31ada16ed5102_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2ab7f3ea6fc43a1d7ad31ada16ed5102_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2ab7f3ea6fc43a1d7ad31ada16ed5102_JaffaCakes118.exe"
2⤵
PID:2132

memory/1948-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1948-2-0x0000000000550000-0x0000000000560000-memory.dmp

Filesize
64KB

Download
memory/1948-1-0x0000000000550000-0x0000000000560000-memory.dmp

Filesize
64KB

Download
memory/1948-4-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/2132-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2132-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2132-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2132-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download