azorult | 578549f540efa7b6a77bc10cfe86f84d4303e734c26578403aae64e2278f9488

Analysis

max time kernel
139s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 16:31

Target

506bb58a4d228dc9795dddc77974fb1a_JaffaCakes118.exe
Size

735KB
MD5

506bb58a4d228dc9795dddc77974fb1a
SHA1

00f8fe7ca7622830d7b7f1ac53ff0fd71865bf60
SHA256

578549f540efa7b6a77bc10cfe86f84d4303e734c26578403aae64e2278f9488
SHA512

596aba0620009d786ac97d1e8811dd1a4ca3b2c50de9194775c844c9e39440b81882a0e4752881212b0487aa16c2b1d5ff3d5f232cd38c4aa5f8e38bc2e54149
SSDEEP

12288:/S1ROskQSIK8ZbWrlc6iv+6ip1zeO2nVM8hGgV7C+mSb8wR8CLfHWmAW:/SW6SIhZbWsv+6szFB8hxeifRf2mF

Score

10^/10

Family

azorult

http://ciuj.ir/showmoney/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 116 set thread context of 1412	116	506bb58a4d228dc9795dddc77974fb1a_JaffaCakes118.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
116	506bb58a4d228dc9795dddc77974fb1a_JaffaCakes118.exe
116	506bb58a4d228dc9795dddc77974fb1a_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
116	506bb58a4d228dc9795dddc77974fb1a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 1412	116	506bb58a4d228dc9795dddc77974fb1a_JaffaCakes118.exe	83
PID 116 wrote to memory of 1412	116	506bb58a4d228dc9795dddc77974fb1a_JaffaCakes118.exe	83
PID 116 wrote to memory of 1412	116	506bb58a4d228dc9795dddc77974fb1a_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\506bb58a4d228dc9795dddc77974fb1a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\506bb58a4d228dc9795dddc77974fb1a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:116
- C:\Users\Admin\AppData\Local\Temp\506bb58a4d228dc9795dddc77974fb1a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\506bb58a4d228dc9795dddc77974fb1a_JaffaCakes118.exe"
  2⤵
  PID:1412

memory/116-0-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/116-1-0x0000000002410000-0x0000000002422000-memory.dmp

Filesize
72KB

Download
memory/116-4-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/116-6-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1412-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1412-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1412-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1412-9-0x0000000000420000-0x00000000004E9000-memory.dmp

Filesize
804KB

Download
memory/1412-11-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download