azorult | 8403fcac5753889bca8e6df68f5401d79e817927835442163741b25ece9db2bb

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45a976181284b3419e55320b93994da9_JaffaCakes118.exe
Size

692KB
MD5

45a976181284b3419e55320b93994da9
SHA1

b72634b5d162e331925535285eb6e5b541842506
SHA256

8403fcac5753889bca8e6df68f5401d79e817927835442163741b25ece9db2bb
SHA512

661444d5c398c00f27afb0469cd8844b42b3d0126d3187955bfabebfe50d6b0be2525587f6c059c54bc81a594540221e654b2f0a88833182aa8a0ca8baea9b39
SSDEEP

12288:nIz8TpSPVV+RmDzFL2AB47uggFa24TLoI2qQ4SDY:vToPV+OFBmuNay9DY

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://185.195.236.168/1gw3/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1624 set thread context of 2504	1624	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1624	45a976181284b3419e55320b93994da9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2504	1624	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	28
PID 1624 wrote to memory of 2504	1624	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	28
PID 1624 wrote to memory of 2504	1624	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	28
PID 1624 wrote to memory of 2504	1624	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	28
PID 1624 wrote to memory of 2504	1624	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	28
PID 1624 wrote to memory of 2504	1624	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	28
PID 1624 wrote to memory of 2504	1624	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	28
PID 1624 wrote to memory of 2504	1624	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	28
PID 1624 wrote to memory of 2504	1624	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	28
PID 1624 wrote to memory of 2504	1624	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\45a976181284b3419e55320b93994da9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\45a976181284b3419e55320b93994da9_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
  2⤵
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1624-28-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-57-0x0000000000550000-0x0000000000570000-memory.dmp

Filesize
128KB

Download
memory/1624-2-0x0000000000510000-0x0000000000556000-memory.dmp

Filesize
280KB

Download
memory/1624-3-0x0000000000290000-0x00000000002B6000-memory.dmp

Filesize
152KB

Download
memory/1624-4-0x0000000074800000-0x0000000074EEE000-memory.dmp

Filesize
6.9MB

Download
memory/1624-5-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-18-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-30-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-56-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-54-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-52-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-50-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-48-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-46-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-44-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-42-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-0-0x000000007480E000-0x000000007480F000-memory.dmp

Filesize
4KB

Download
memory/1624-70-0x0000000074800000-0x0000000074EEE000-memory.dmp

Filesize
6.9MB

Download
memory/1624-38-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-36-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-34-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-32-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-24-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-1-0x00000000010A0000-0x0000000001154000-memory.dmp

Filesize
720KB

Download
memory/1624-40-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-22-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-20-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-16-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-14-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-12-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-10-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-8-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-6-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-26-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-58-0x0000000074800000-0x0000000074EEE000-memory.dmp

Filesize
6.9MB

Download
memory/2504-71-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2504-64-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2504-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2504-68-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2504-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2504-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2504-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2504-59-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2504-69-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2504-66-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2504-78-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download