azorult | 8403fcac5753889bca8e6df68f5401d79e817927835442163741b25ece9db2bb

Analysis

max time kernel
132s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45a976181284b3419e55320b93994da9_JaffaCakes118.exe
Size

692KB
MD5

45a976181284b3419e55320b93994da9
SHA1

b72634b5d162e331925535285eb6e5b541842506
SHA256

8403fcac5753889bca8e6df68f5401d79e817927835442163741b25ece9db2bb
SHA512

661444d5c398c00f27afb0469cd8844b42b3d0126d3187955bfabebfe50d6b0be2525587f6c059c54bc81a594540221e654b2f0a88833182aa8a0ca8baea9b39
SSDEEP

12288:nIz8TpSPVV+RmDzFL2AB47uggFa24TLoI2qQ4SDY:vToPV+OFBmuNay9DY

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://185.195.236.168/1gw3/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3048 set thread context of 2968	3048	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	85

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3048	45a976181284b3419e55320b93994da9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2968	3048	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	85
PID 3048 wrote to memory of 2968	3048	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	85
PID 3048 wrote to memory of 2968	3048	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	85
PID 3048 wrote to memory of 2968	3048	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	85
PID 3048 wrote to memory of 2968	3048	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	85
PID 3048 wrote to memory of 2968	3048	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	85
PID 3048 wrote to memory of 2968	3048	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	85
PID 3048 wrote to memory of 2968	3048	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	85
PID 3048 wrote to memory of 2968	3048	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\45a976181284b3419e55320b93994da9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\45a976181284b3419e55320b93994da9_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
  2⤵
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2968-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2968-72-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2968-70-0x0000000000470000-0x0000000000539000-memory.dmp

Filesize
804KB

Download
memory/2968-67-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2968-66-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2968-64-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2968-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3048-24-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-12-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-53-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-50-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-48-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-46-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-44-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-40-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-38-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-34-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-32-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-30-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-26-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-0-0x00000000743DE000-0x00000000743DF000-memory.dmp

Filesize
4KB

Download
memory/3048-22-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-20-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-16-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-54-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-10-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-8-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-36-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-28-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-18-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-14-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-6-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-5-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-58-0x0000000005BC0000-0x0000000005C5C000-memory.dmp

Filesize
624KB

Download
memory/3048-59-0x00000000743D0000-0x0000000074B80000-memory.dmp

Filesize
7.7MB

Download
memory/3048-57-0x00000000034A0000-0x00000000034C0000-memory.dmp

Filesize
128KB

Download
memory/3048-56-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-42-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-65-0x00000000743D0000-0x0000000074B80000-memory.dmp

Filesize
7.7MB

Download
memory/3048-4-0x00000000743D0000-0x0000000074B80000-memory.dmp

Filesize
7.7MB

Download
memory/3048-3-0x0000000003310000-0x0000000003336000-memory.dmp

Filesize
152KB

Download
memory/3048-2-0x0000000003430000-0x0000000003476000-memory.dmp

Filesize
280KB

Download
memory/3048-1-0x0000000000EF0000-0x0000000000FA4000-memory.dmp

Filesize
720KB

Download