azorult | 2bdf9811d9fdc64acc21f88900c8f8054c900c009a98bb1efed40f64be259115

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-05-2024 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe
Size

420KB
MD5

54b1ee633e49544e5bb6099dd576663e
SHA1

0c844bf459777740a4d7fa71510da4d5d6ee1530
SHA256

2bdf9811d9fdc64acc21f88900c8f8054c900c009a98bb1efed40f64be259115
SHA512

2c0bfebd90c434f5b710eb27d2833f0c3010a6c301b8941de825e44d8a2420c53d086d794e39a9d3bbeca450111f59fd6e59895694552a8ee23adcadad0531ac
SSDEEP

6144:Ft7UUAVmnPbDLl9QsHvcrEi78gJ9KEXV4/lX:rUUEmXLl9QsGQE9KEFml

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://gebbatrip.club/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2256 set thread context of 1876	2256	54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe	28

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe
File opened for modification	C:\Windows\win.ini	54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2256	54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe
2256	54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe
1876	54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe
1876	54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2256	54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe
2256	54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe
1876	54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe
1876	54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2256	54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe
1876	54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 1876	2256	54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe	28
PID 2256 wrote to memory of 1876	2256	54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe	28
PID 2256 wrote to memory of 1876	2256	54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe	28
PID 2256 wrote to memory of 1876	2256	54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win.ini

Filesize
509B

MD5
d2a2412bddba16d60ec63bd9550d933f

SHA1
deb3d3bdc9055f0b4909b31d3048446848fae0e1

SHA256
79ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a

SHA512
8fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31

Download Submit
memory/1876-11-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1876-13-0x0000000077200000-0x00000000773A9000-memory.dmp

Filesize
1.7MB

Download
memory/1876-15-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2256-2-0x0000000002730000-0x0000000002770000-memory.dmp

Filesize
256KB

Download
memory/2256-3-0x0000000002730000-0x0000000002770000-memory.dmp

Filesize
256KB

Download
memory/2256-5-0x0000000077201000-0x0000000077302000-memory.dmp

Filesize
1.0MB

Download
memory/2256-6-0x0000000077200000-0x00000000773A9000-memory.dmp

Filesize
1.7MB

Download