azorult | 3bdbd65cfc219275bee9e9b4f3100966ae385efe1a433bbb1c00ef305034692e

General

Target

64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe
Size

407KB
MD5

64679e65c0e04ebb44765a3761884644
SHA1

eb587ead2bea6dd27dd31f2fe884bcddb24d4277
SHA256

3bdbd65cfc219275bee9e9b4f3100966ae385efe1a433bbb1c00ef305034692e
SHA512

a84f089e1f26d78e8a831588d4388f1af44cbf4fa741840187f438f66dde840a66f8c80e6ecd9c0869cf186233e5b0e2b9623022f100867c891ad513fba34a6b
SSDEEP

6144:YGeJ7zuOrSyJ0tpaP8DSdBbUpof2YAxvWKg6jlH3Hu51:YVrSyJ0tp+b/Qpof2YAWqg1

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

https://medireab.ga/abs/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2636	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1764 set thread context of 2636	1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe	29

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe
1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe
1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe
1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe
1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe
1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe
1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe
1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe
1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe
1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe
1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe
1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe
1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe
1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe
1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe
1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 2636	1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe	29
PID 1764 wrote to memory of 2636	1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe	29
PID 1764 wrote to memory of 2636	1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe	29
PID 1764 wrote to memory of 2636	1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe	29
PID 1764 wrote to memory of 2636	1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe	29
PID 1764 wrote to memory of 2636	1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe	29
PID 1764 wrote to memory of 2636	1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe	29
PID 1764 wrote to memory of 2636	1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe	29
PID 1764 wrote to memory of 2636	1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe	29
PID 1764 wrote to memory of 2636	1764	64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Users\Admin\AppData\Local\Temp\64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  PID:2636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\64679e65c0e04ebb44765a3761884644_JaffaCakes118.exe

Filesize
407KB

MD5
64679e65c0e04ebb44765a3761884644

SHA1
eb587ead2bea6dd27dd31f2fe884bcddb24d4277

SHA256
3bdbd65cfc219275bee9e9b4f3100966ae385efe1a433bbb1c00ef305034692e

SHA512
a84f089e1f26d78e8a831588d4388f1af44cbf4fa741840187f438f66dde840a66f8c80e6ecd9c0869cf186233e5b0e2b9623022f100867c891ad513fba34a6b

Download Submit
memory/1764-20-0x0000000074500000-0x0000000074BEE000-memory.dmp

Filesize
6.9MB

Download
memory/1764-1-0x0000000000F20000-0x0000000000F8C000-memory.dmp

Filesize
432KB

Download
memory/1764-2-0x0000000000430000-0x000000000046C000-memory.dmp

Filesize
240KB

Download
memory/1764-3-0x00000000004E0000-0x00000000004EA000-memory.dmp

Filesize
40KB

Download
memory/1764-5-0x0000000074500000-0x0000000074BEE000-memory.dmp

Filesize
6.9MB

Download
memory/1764-6-0x00000000004C0000-0x00000000004CC000-memory.dmp

Filesize
48KB

Download
memory/1764-7-0x00000000006D0000-0x00000000006D8000-memory.dmp

Filesize
32KB

Download
memory/1764-0-0x000000007450E000-0x000000007450F000-memory.dmp

Filesize
4KB

Download
memory/2636-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2636-11-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2636-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2636-16-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2636-13-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2636-12-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2636-21-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2636-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2636-19-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2636-22-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing