azorult | 9eb9e56334ebaa7d666ce954e87d62327be12475faebe5f2d19780baad6a768c

Analysis

max time kernel
132s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 07:08

Target

7135ffc132104c1e9e641628c83ffeb9_JaffaCakes118.exe
Size

210KB
MD5

7135ffc132104c1e9e641628c83ffeb9
SHA1

8a2cb8da0d56d3d0499505d1f839cfcf02610fa0
SHA256

9eb9e56334ebaa7d666ce954e87d62327be12475faebe5f2d19780baad6a768c
SHA512

ebcfc75902fc448b766c550b43c7610758dffda551d7674d348b796bf50288911fb07161e6536c788b50127a4a76e5e2f85bcac456d8352cf2f6f9f30e967f86
SSDEEP

3072:/Al2HtifWeCKXEA1KMNkrFlqJkCxeYbgsYrpM24vCnm9uxnd+2XPBNKHAvZ:/22NKC5A1xyr3AkYF8hpYvEm9IJAA

Score

10^/10

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4220 4760 WerFault.exe 7135ffc132104c1e9e641628c83ffeb9_JaffaCakes118.exe

pid	pid_target	process	target process
4220	4760	WerFault.exe	7135ffc132104c1e9e641628c83ffeb9_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\7135ffc132104c1e9e641628c83ffeb9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7135ffc132104c1e9e641628c83ffeb9_JaffaCakes118.exe"
1⤵
PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 1412
2⤵
- Program crash
PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4760 -ip 4760
1⤵
PID:3472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4436,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
1⤵
PID:1492

memory/4760-0-0x00000000004C0000-0x00000000004D1000-memory.dmp

Filesize
68KB

Download
memory/4760-1-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4760-2-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4760-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4760-3-0x00000000004C0000-0x00000000004D1000-memory.dmp

Filesize
68KB

Download