azorult | 578549f540efa7b6a77bc10cfe86f84d4303e734c26578403aae64e2278f9488

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 23:23

Target

506bb58a4d228dc9795dddc77974fb1aJaffaCakes118.exe
Size

735KB
MD5

506bb58a4d228dc9795dddc77974fb1a
SHA1

00f8fe7ca7622830d7b7f1ac53ff0fd71865bf60
SHA256

578549f540efa7b6a77bc10cfe86f84d4303e734c26578403aae64e2278f9488
SHA512

596aba0620009d786ac97d1e8811dd1a4ca3b2c50de9194775c844c9e39440b81882a0e4752881212b0487aa16c2b1d5ff3d5f232cd38c4aa5f8e38bc2e54149
SSDEEP

12288:/S1ROskQSIK8ZbWrlc6iv+6ip1zeO2nVM8hGgV7C+mSb8wR8CLfHWmAW:/SW6SIhZbWsv+6szFB8hxeifRf2mF

Score

10^/10

Family

azorult

http://ciuj.ir/showmoney/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1964 set thread context of 972	1964	506bb58a4d228dc9795dddc77974fb1aJaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1964	506bb58a4d228dc9795dddc77974fb1aJaffaCakes118.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1964	506bb58a4d228dc9795dddc77974fb1aJaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 972	1964	506bb58a4d228dc9795dddc77974fb1aJaffaCakes118.exe	28
PID 1964 wrote to memory of 972	1964	506bb58a4d228dc9795dddc77974fb1aJaffaCakes118.exe	28
PID 1964 wrote to memory of 972	1964	506bb58a4d228dc9795dddc77974fb1aJaffaCakes118.exe	28
PID 1964 wrote to memory of 972	1964	506bb58a4d228dc9795dddc77974fb1aJaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\506bb58a4d228dc9795dddc77974fb1aJaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\506bb58a4d228dc9795dddc77974fb1aJaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\506bb58a4d228dc9795dddc77974fb1aJaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\506bb58a4d228dc9795dddc77974fb1aJaffaCakes118.exe"
  2⤵
  PID:972

memory/972-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/972-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/972-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/972-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1964-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1964-1-0x0000000000510000-0x0000000000522000-memory.dmp

Filesize
72KB

Download
memory/1964-2-0x0000000000510000-0x0000000000522000-memory.dmp

Filesize
72KB

Download
memory/1964-3-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/1964-5-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download