azorult | f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 23:00

Target

4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe
Size

598KB
MD5

4872dfbfd5180fb118d93b9a786d1eb0
SHA1

0d42a59ef21ec45a8317d828111ab49beea8b312
SHA256

f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901
SHA512

b8887871ec530484e77e16af1afd10599f8df9cdca63af0fd14f5b1e730d30d3e4790bd15fcd46f8b014bc4e5452be72819993bfa336d9e09ae2f283c69b4ae2
SSDEEP

12288:DK5Iwbvs4CF35Z6ifckPyznczJJsICBX0:Wnva352xzczJJrC

Score

10^/10

Family

azorult

http://185.43.220.15/~yafpn149/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe

description	pid	process	target process
PID 4808 set thread context of 4528	4808	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3984 4528 WerFault.exe 4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe

pid	pid_target	process	target process
3984	4528	WerFault.exe	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe

pid	process
4808	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe
4808	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe
4808	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 4808 4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	4808	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe

description	pid	process	target process
PID 4808 wrote to memory of 3920	4808	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe
PID 4808 wrote to memory of 3920	4808	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe
PID 4808 wrote to memory of 3920	4808	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe
PID 4808 wrote to memory of 2136	4808	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe
PID 4808 wrote to memory of 2136	4808	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe
PID 4808 wrote to memory of 2136	4808	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe
PID 4808 wrote to memory of 4528	4808	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe
PID 4808 wrote to memory of 4528	4808	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe
PID 4808 wrote to memory of 4528	4808	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe
PID 4808 wrote to memory of 4528	4808	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe	4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe
"4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe"
2⤵
PID:3920

C:\Users\Admin\AppData\Local\Temp\4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe
"4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe"
2⤵
PID:2136

C:\Users\Admin\AppData\Local\Temp\4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe
"4872dfbfd5180fb118d93b9a786d1eb0_JaffaCakes118.exe"
2⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 1208
3⤵
- Program crash
PID:3984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4528 -ip 4528
1⤵
PID:2720

memory/4528-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4528-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4528-9-0x0000000074B40000-0x0000000075148000-memory.dmp

Filesize
6.0MB

Download
memory/4528-10-0x0000000074B40000-0x0000000075148000-memory.dmp

Filesize
6.0MB

Download
memory/4808-0-0x0000000074EAE000-0x0000000074EAF000-memory.dmp

Filesize
4KB

Download
memory/4808-1-0x00000000008A0000-0x000000000093C000-memory.dmp

Filesize
624KB

Download
memory/4808-2-0x00000000051E0000-0x000000000520C000-memory.dmp

Filesize
176KB

Download
memory/4808-7-0x0000000005360000-0x0000000005363000-memory.dmp

Filesize
12KB

Download
memory/4808-8-0x0000000074EA0000-0x0000000075650000-memory.dmp

Filesize
7.7MB

Download
memory/4808-11-0x0000000074EA0000-0x0000000075650000-memory.dmp

Filesize
7.7MB

Download