azorult | 8403fcac5753889bca8e6df68f5401d79e817927835442163741b25ece9db2bb

General

Target

45a976181284b3419e55320b93994da9_JaffaCakes118.exe
Size

692KB
MD5

45a976181284b3419e55320b93994da9
SHA1

b72634b5d162e331925535285eb6e5b541842506
SHA256

8403fcac5753889bca8e6df68f5401d79e817927835442163741b25ece9db2bb
SHA512

661444d5c398c00f27afb0469cd8844b42b3d0126d3187955bfabebfe50d6b0be2525587f6c059c54bc81a594540221e654b2f0a88833182aa8a0ca8baea9b39
SSDEEP

12288:nIz8TpSPVV+RmDzFL2AB47uggFa24TLoI2qQ4SDY:vToPV+OFBmuNay9DY

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://185.195.236.168/1gw3/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

45a976181284b3419e55320b93994da9_JaffaCakes118.exe

description pid process target process

PID 3048 set thread context of 2968 3048 45a976181284b3419e55320b93994da9_JaffaCakes118.exe vbc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

45a976181284b3419e55320b93994da9_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 3048 45a976181284b3419e55320b93994da9_JaffaCakes118.exe

description	pid	process	target process
PID 3048 set thread context of 2968	3048	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	vbc.exe

description	pid	process
Token: SeDebugPrivilege	3048	45a976181284b3419e55320b93994da9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

45a976181284b3419e55320b93994da9_JaffaCakes118.exe

description	pid	process	target process
PID 3048 wrote to memory of 2968	3048	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	vbc.exe
PID 3048 wrote to memory of 2968	3048	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	vbc.exe
PID 3048 wrote to memory of 2968	3048	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	vbc.exe
PID 3048 wrote to memory of 2968	3048	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	vbc.exe
PID 3048 wrote to memory of 2968	3048	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	vbc.exe
PID 3048 wrote to memory of 2968	3048	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	vbc.exe
PID 3048 wrote to memory of 2968	3048	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	vbc.exe
PID 3048 wrote to memory of 2968	3048	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	vbc.exe
PID 3048 wrote to memory of 2968	3048	45a976181284b3419e55320b93994da9_JaffaCakes118.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\45a976181284b3419e55320b93994da9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\45a976181284b3419e55320b93994da9_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
2⤵
PID:2968

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2968-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2968-72-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2968-70-0x0000000000470000-0x0000000000539000-memory.dmp

Filesize
804KB

Download
memory/2968-67-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2968-66-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2968-64-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2968-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3048-24-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-12-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-53-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-50-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-48-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-46-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-44-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-40-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-38-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-34-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-32-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-30-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-26-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-0-0x00000000743DE000-0x00000000743DF000-memory.dmp

Filesize
4KB

Download
memory/3048-22-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-20-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-16-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-54-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-10-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-8-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-36-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-28-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-18-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-14-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-6-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-5-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-58-0x0000000005BC0000-0x0000000005C5C000-memory.dmp

Filesize
624KB

Download
memory/3048-59-0x00000000743D0000-0x0000000074B80000-memory.dmp

Filesize
7.7MB

Download
memory/3048-57-0x00000000034A0000-0x00000000034C0000-memory.dmp

Filesize
128KB

Download
memory/3048-56-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-42-0x0000000003310000-0x000000000332F000-memory.dmp

Filesize
124KB

Download
memory/3048-65-0x00000000743D0000-0x0000000074B80000-memory.dmp

Filesize
7.7MB

Download
memory/3048-4-0x00000000743D0000-0x0000000074B80000-memory.dmp

Filesize
7.7MB

Download
memory/3048-3-0x0000000003310000-0x0000000003336000-memory.dmp

Filesize
152KB

Download
memory/3048-2-0x0000000003430000-0x0000000003476000-memory.dmp

Filesize
280KB

Download
memory/3048-1-0x0000000000EF0000-0x0000000000FA4000-memory.dmp

Filesize
720KB

Download

Analysis

Sharing