azorult | 2accfbc3e93bbfde22d833a6e3d8b5a53b3e8d2f6d38ab3e2bfb86fa2cb7a196

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe
Size

345KB
MD5

3d7e0748f65f6d55887fab28de98bbde
SHA1

0700ff40bde7331b2145839e2d3f53d2281b0c29
SHA256

2accfbc3e93bbfde22d833a6e3d8b5a53b3e8d2f6d38ab3e2bfb86fa2cb7a196
SHA512

0b9df3e0eca4b49604e61f3c131a9a57744e65baa4d0a4acd4e45159e20fb0924ba268c964d90a72d2fb646a2b15000526c2c5924acf9202682675becf26be23
SSDEEP

6144:lWKjIfJveskxogPcqCyA+D7v3JM+RKusJ7S7tGYIqt8jN8:bjIfQXxvCyAEb3JWJ+xai

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://abae.us/petit/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe

description	pid	process	target process
PID 2968 set thread context of 2584	2968	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2968	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe
Token: 33	2968	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2968	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe

description	pid	process	target process
PID 2968 wrote to memory of 2584	2968	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe
PID 2968 wrote to memory of 2584	2968	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe
PID 2968 wrote to memory of 2584	2968	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe
PID 2968 wrote to memory of 2584	2968	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe
PID 2968 wrote to memory of 2584	2968	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe
PID 2968 wrote to memory of 2584	2968	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe
PID 2968 wrote to memory of 2584	2968	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe
PID 2968 wrote to memory of 2584	2968	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe
PID 2968 wrote to memory of 2584	2968	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe
PID 2968 wrote to memory of 2584	2968	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968

C:\Users\Admin\AppData\Local\Temp\3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe"
2⤵
PID:2584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2584-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2584-20-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2584-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2584-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2584-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2584-12-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2584-14-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2584-18-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2968-5-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/2968-4-0x0000000000200000-0x000000000020C000-memory.dmp

Filesize
48KB

Download
memory/2968-7-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/2968-2-0x00000000002C0000-0x00000000002DC000-memory.dmp

Filesize
112KB

Download
memory/2968-0-0x000000007455E000-0x000000007455F000-memory.dmp

Filesize
4KB

Download
memory/2968-6-0x000000007455E000-0x000000007455F000-memory.dmp

Filesize
4KB

Download
memory/2968-1-0x0000000001190000-0x00000000011EC000-memory.dmp

Filesize
368KB

Download
memory/2968-3-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/2968-21-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download