azorult | 578549f540efa7b6a77bc10cfe86f84d4303e734c26578403aae64e2278f9488

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 16:31

Target

506bb58a4d228dc9795dddc77974fb1a_JaffaCakes118.exe
Size

735KB
MD5

506bb58a4d228dc9795dddc77974fb1a
SHA1

00f8fe7ca7622830d7b7f1ac53ff0fd71865bf60
SHA256

578549f540efa7b6a77bc10cfe86f84d4303e734c26578403aae64e2278f9488
SHA512

596aba0620009d786ac97d1e8811dd1a4ca3b2c50de9194775c844c9e39440b81882a0e4752881212b0487aa16c2b1d5ff3d5f232cd38c4aa5f8e38bc2e54149
SSDEEP

12288:/S1ROskQSIK8ZbWrlc6iv+6ip1zeO2nVM8hGgV7C+mSb8wR8CLfHWmAW:/SW6SIhZbWsv+6szFB8hxeifRf2mF

Score

10^/10

Family

azorult

http://ciuj.ir/showmoney/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1712 set thread context of 1760	1712	506bb58a4d228dc9795dddc77974fb1a_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1712	506bb58a4d228dc9795dddc77974fb1a_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1712	506bb58a4d228dc9795dddc77974fb1a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1760	1712	506bb58a4d228dc9795dddc77974fb1a_JaffaCakes118.exe	28
PID 1712 wrote to memory of 1760	1712	506bb58a4d228dc9795dddc77974fb1a_JaffaCakes118.exe	28
PID 1712 wrote to memory of 1760	1712	506bb58a4d228dc9795dddc77974fb1a_JaffaCakes118.exe	28
PID 1712 wrote to memory of 1760	1712	506bb58a4d228dc9795dddc77974fb1a_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\506bb58a4d228dc9795dddc77974fb1a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\506bb58a4d228dc9795dddc77974fb1a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Users\Admin\AppData\Local\Temp\506bb58a4d228dc9795dddc77974fb1a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\506bb58a4d228dc9795dddc77974fb1a_JaffaCakes118.exe"
  2⤵
  PID:1760

memory/1712-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1712-1-0x0000000000370000-0x0000000000382000-memory.dmp

Filesize
72KB

Download
memory/1712-2-0x0000000000370000-0x0000000000382000-memory.dmp

Filesize
72KB

Download
memory/1712-3-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1712-5-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1760-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1760-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1760-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1760-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download