azorult | 2accfbc3e93bbfde22d833a6e3d8b5a53b3e8d2f6d38ab3e2bfb86fa2cb7a196

Analysis

max time kernel
130s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 02:04

Target

3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe
Size

345KB
MD5

3d7e0748f65f6d55887fab28de98bbde
SHA1

0700ff40bde7331b2145839e2d3f53d2281b0c29
SHA256

2accfbc3e93bbfde22d833a6e3d8b5a53b3e8d2f6d38ab3e2bfb86fa2cb7a196
SHA512

0b9df3e0eca4b49604e61f3c131a9a57744e65baa4d0a4acd4e45159e20fb0924ba268c964d90a72d2fb646a2b15000526c2c5924acf9202682675becf26be23
SSDEEP

6144:lWKjIfJveskxogPcqCyA+D7v3JM+RKusJ7S7tGYIqt8jN8:bjIfQXxvCyAEb3JWJ+xai

Score

10^/10

Family

azorult

http://abae.us/petit/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3576 set thread context of 2064	3576	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe	98

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3576	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe
Token: 33	3576	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3576	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 2064	3576	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe	98
PID 3576 wrote to memory of 2064	3576	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe	98
PID 3576 wrote to memory of 2064	3576	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe	98
PID 3576 wrote to memory of 2064	3576	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe	98
PID 3576 wrote to memory of 2064	3576	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe	98
PID 3576 wrote to memory of 2064	3576	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe	98
PID 3576 wrote to memory of 2064	3576	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe	98
PID 3576 wrote to memory of 2064	3576	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe	98
PID 3576 wrote to memory of 2064	3576	3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe	98

C:\Users\Admin\AppData\Local\Temp\3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Users\Admin\AppData\Local\Temp\3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3d7e0748f65f6d55887fab28de98bbde_JaffaCakes118.exe"
  2⤵
  PID:2064

memory/2064-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2064-16-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2064-14-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2064-12-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3576-6-0x0000000002A20000-0x0000000002A2C000-memory.dmp

Filesize
48KB

Download
memory/3576-5-0x0000000074A80000-0x0000000075230000-memory.dmp

Filesize
7.7MB

Download
memory/3576-0-0x0000000074A8E000-0x0000000074A8F000-memory.dmp

Filesize
4KB

Download
memory/3576-7-0x0000000074A8E000-0x0000000074A8F000-memory.dmp

Filesize
4KB

Download
memory/3576-8-0x0000000074A80000-0x0000000075230000-memory.dmp

Filesize
7.7MB

Download
memory/3576-9-0x0000000005E00000-0x0000000005E9C000-memory.dmp

Filesize
624KB

Download
memory/3576-4-0x00000000055B0000-0x0000000005B54000-memory.dmp

Filesize
5.6MB

Download
memory/3576-3-0x0000000002A00000-0x0000000002A1C000-memory.dmp

Filesize
112KB

Download
memory/3576-2-0x0000000004EA0000-0x0000000004F32000-memory.dmp

Filesize
584KB

Download
memory/3576-15-0x0000000074A80000-0x0000000075230000-memory.dmp

Filesize
7.7MB

Download
memory/3576-1-0x00000000004E0000-0x000000000053C000-memory.dmp

Filesize
368KB

Download