azorult | 76861d2fc58dd47dbed932d546aa8bf8d1fdf203bad72bca5b44dd91b444b430

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 10:50

Target

3434e1bb482521b94c51ba4c2152b201_JaffaCakes118.exe
Size

337KB
MD5

3434e1bb482521b94c51ba4c2152b201
SHA1

984bc3bf09fb42aa8e8e123adccf5a3d01618775
SHA256

76861d2fc58dd47dbed932d546aa8bf8d1fdf203bad72bca5b44dd91b444b430
SHA512

d8fef9f6d2f247378f914b20e9d93428c60aa2bd5d845c1b17d302b7020651b926fe9c80679a2b5ab96abbdd37c5105df5b3c98878ddce98ee9e53e51eb30217
SSDEEP

3072:7Rx4lr/py/kFg+DIB9asfk3PYme79nDAi5bwI94aqkeBt6DZCz3bdDp:7RyaF1/fJnDNbwW4fRd5p

Score

10^/10

Family

azorult

http://rakaka.om-nom-nom.li/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

116 612 WerFault.exe 3434e1bb482521b94c51ba4c2152b201_JaffaCakes118.exe

pid	pid_target	process	target process
116	612	WerFault.exe	3434e1bb482521b94c51ba4c2152b201_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

3434e1bb482521b94c51ba4c2152b201_JaffaCakes118.exe

description	pid	process	target process
PID 612 wrote to memory of 536	612	3434e1bb482521b94c51ba4c2152b201_JaffaCakes118.exe	splwow64.exe
PID 612 wrote to memory of 536	612	3434e1bb482521b94c51ba4c2152b201_JaffaCakes118.exe	splwow64.exe

C:\Users\Admin\AppData\Local\Temp\3434e1bb482521b94c51ba4c2152b201_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3434e1bb482521b94c51ba4c2152b201_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 612 -s 744
2⤵
- Program crash
PID:116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 612 -ip 612
1⤵
PID:2940

memory/612-0-0x00000000006C0000-0x00000000006D0000-memory.dmp

Filesize
64KB

Download
memory/612-1-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/612-2-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/612-3-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download