azorult | e81ae51d70f71f356608ad0b72ce8747bf09af7d7734c59f9323488bc8516cbd

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 14:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe
Size

424KB
MD5

5f96cffd883eeeba8ff3296dca4e450c
SHA1

80f1c73f1b858d9074ac7759d6a9a51646a8c55f
SHA256

e81ae51d70f71f356608ad0b72ce8747bf09af7d7734c59f9323488bc8516cbd
SHA512

ed6d41459c395466a9f632d7c449b794571e84324d26b89c305d388fdfe3f842b3ad9d8aae2846d00ebb713367cb65703254c761f4288069d2f96e5003343280
SSDEEP

6144:QdadU3UfcnyRVwwJCgttCeDqeYS7STC5zYKP8/5ypfKFtSUfsdjZEWM9Kv41DW3E:QdadU3v2wmhQ0QDQMFInEWMQaS74

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://googletime.ug/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe

description	pid	process	target process
PID 2908 set thread context of 2536	2908	5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe	5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2908 5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2908	5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe

description	pid	process	target process
PID 2908 wrote to memory of 2536	2908	5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe	5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe
PID 2908 wrote to memory of 2536	2908	5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe	5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe
PID 2908 wrote to memory of 2536	2908	5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe	5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe
PID 2908 wrote to memory of 2536	2908	5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe	5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe
PID 2908 wrote to memory of 2536	2908	5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe	5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe
PID 2908 wrote to memory of 2536	2908	5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe	5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe
PID 2908 wrote to memory of 2536	2908	5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe	5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe
PID 2908 wrote to memory of 2536	2908	5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe	5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe
PID 2908 wrote to memory of 2536	2908	5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe	5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe
PID 2908 wrote to memory of 2536	2908	5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe	5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908

C:\Users\Admin\AppData\Local\Temp\5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5f96cffd883eeeba8ff3296dca4e450c_JaffaCakes118.exe"
2⤵
PID:2536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2536-16-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2536-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2536-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2536-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2536-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2536-11-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2536-14-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2536-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2536-19-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2536-17-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2908-5-0x0000000074050000-0x000000007473E000-memory.dmp

Filesize
6.9MB

Download
memory/2908-3-0x0000000074050000-0x000000007473E000-memory.dmp

Filesize
6.9MB

Download
memory/2908-0-0x000000007405E000-0x000000007405F000-memory.dmp

Filesize
4KB

Download
memory/2908-2-0x0000000000550000-0x000000000056A000-memory.dmp

Filesize
104KB

Download
memory/2908-6-0x0000000074050000-0x000000007473E000-memory.dmp

Filesize
6.9MB

Download
memory/2908-1-0x0000000001290000-0x00000000012F4000-memory.dmp

Filesize
400KB

Download
memory/2908-18-0x0000000074050000-0x000000007473E000-memory.dmp

Filesize
6.9MB

Download
memory/2908-4-0x000000007405E000-0x000000007405F000-memory.dmp

Filesize
4KB

Download