azorult | 8403fcac5753889bca8e6df68f5401d79e817927835442163741b25ece9db2bb

General

Target

45a976181284b3419e55320b93994da9_JaffaCakes118.exe
Size

692KB
MD5

45a976181284b3419e55320b93994da9
SHA1

b72634b5d162e331925535285eb6e5b541842506
SHA256

8403fcac5753889bca8e6df68f5401d79e817927835442163741b25ece9db2bb
SHA512

661444d5c398c00f27afb0469cd8844b42b3d0126d3187955bfabebfe50d6b0be2525587f6c059c54bc81a594540221e654b2f0a88833182aa8a0ca8baea9b39
SSDEEP

12288:nIz8TpSPVV+RmDzFL2AB47uggFa24TLoI2qQ4SDY:vToPV+OFBmuNay9DY

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://185.195.236.168/1gw3/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

45a976181284b3419e55320b93994da9_JaffaCakes118.exe

description pid process target process

PID 1624 set thread context of 2504 1624 45a976181284b3419e55320b93994da9_JaffaCakes118.exe vbc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

45a976181284b3419e55320b93994da9_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 1624 45a976181284b3419e55320b93994da9_JaffaCakes118.exe

description	pid	process	target process
PID 1624 set thread context of 2504	1624	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	vbc.exe

description	pid	process
Token: SeDebugPrivilege	1624	45a976181284b3419e55320b93994da9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

45a976181284b3419e55320b93994da9_JaffaCakes118.exe

description	pid	process	target process
PID 1624 wrote to memory of 2504	1624	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	vbc.exe
PID 1624 wrote to memory of 2504	1624	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	vbc.exe
PID 1624 wrote to memory of 2504	1624	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	vbc.exe
PID 1624 wrote to memory of 2504	1624	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	vbc.exe
PID 1624 wrote to memory of 2504	1624	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	vbc.exe
PID 1624 wrote to memory of 2504	1624	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	vbc.exe
PID 1624 wrote to memory of 2504	1624	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	vbc.exe
PID 1624 wrote to memory of 2504	1624	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	vbc.exe
PID 1624 wrote to memory of 2504	1624	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	vbc.exe
PID 1624 wrote to memory of 2504	1624	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\45a976181284b3419e55320b93994da9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\45a976181284b3419e55320b93994da9_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
2⤵
PID:2504

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1624-28-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-57-0x0000000000550000-0x0000000000570000-memory.dmp

Filesize
128KB

Download
memory/1624-2-0x0000000000510000-0x0000000000556000-memory.dmp

Filesize
280KB

Download
memory/1624-3-0x0000000000290000-0x00000000002B6000-memory.dmp

Filesize
152KB

Download
memory/1624-4-0x0000000074800000-0x0000000074EEE000-memory.dmp

Filesize
6.9MB

Download
memory/1624-5-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-18-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-30-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-56-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-54-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-52-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-50-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-48-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-46-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-44-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-42-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-0-0x000000007480E000-0x000000007480F000-memory.dmp

Filesize
4KB

Download
memory/1624-70-0x0000000074800000-0x0000000074EEE000-memory.dmp

Filesize
6.9MB

Download
memory/1624-38-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-36-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-34-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-32-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-24-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-1-0x00000000010A0000-0x0000000001154000-memory.dmp

Filesize
720KB

Download
memory/1624-40-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-22-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-20-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-16-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-14-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-12-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-10-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-8-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-6-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-26-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/1624-58-0x0000000074800000-0x0000000074EEE000-memory.dmp

Filesize
6.9MB

Download
memory/2504-71-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2504-64-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2504-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2504-68-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2504-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2504-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2504-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2504-59-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2504-69-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2504-66-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2504-78-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing