azorult | 1e7fb271b11372c8168c3b5eccbc903d330e9bf8cd2135c9dc13eb14d11c2518

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-06-2024 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9bb3638f28f1184c0ca0c1500d6698d6_JaffaCakes118.exe
Size

2.6MB
MD5

9bb3638f28f1184c0ca0c1500d6698d6
SHA1

4b0d028f70841dc794cb9eb696366ce6eb4ba6f0
SHA256

1e7fb271b11372c8168c3b5eccbc903d330e9bf8cd2135c9dc13eb14d11c2518
SHA512

6cf483a1ffa7aec827e7512dd3909a3e21cb2afd97518d95fcdc736985732b13d118db6c4c9e4dc3bcb665646a080338f389eed149520a0803bc8f2a20a38d64
SSDEEP

49152:JUHl/k49nQVhOojoeokJYaBuIx/rRt7dLiT4AQkrEoMjlsm8GwJIc1JqCV:G959Q6C7oBoF371UIZDc9WK

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://51.75.122.235/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

9bb3638f28f1184c0ca0c1500d6698d6_JaffaCakes118.exe

description	pid	process
Token: 33	3056	9bb3638f28f1184c0ca0c1500d6698d6_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3056	9bb3638f28f1184c0ca0c1500d6698d6_JaffaCakes118.exe
Token: 33	3056	9bb3638f28f1184c0ca0c1500d6698d6_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3056	9bb3638f28f1184c0ca0c1500d6698d6_JaffaCakes118.exe
Token: 33	3056	9bb3638f28f1184c0ca0c1500d6698d6_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3056	9bb3638f28f1184c0ca0c1500d6698d6_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

Processes:

9bb3638f28f1184c0ca0c1500d6698d6_JaffaCakes118.exe

pid process

3056 9bb3638f28f1184c0ca0c1500d6698d6_JaffaCakes118.exe
3056 9bb3638f28f1184c0ca0c1500d6698d6_JaffaCakes118.exe

pid	process
3056	9bb3638f28f1184c0ca0c1500d6698d6_JaffaCakes118.exe
3056	9bb3638f28f1184c0ca0c1500d6698d6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\9bb3638f28f1184c0ca0c1500d6698d6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9bb3638f28f1184c0ca0c1500d6698d6_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SPOON\CACHE\0x1C1A85E55832CA3F\sxs\Manifests\10765.exe_0x89c79f2c61b4b5ba913dadccfc2509e1.1.manifest

Filesize
379B

MD5
73102579f0cc3777bdd0ba96bab8d6f4

SHA1
08512e731aed9cdfeebf2e8fdc24a35ea23e3477

SHA256
03c937a5aba7fd7eab8ae959606ea4598e474da06b7ec63701255e7325a9e435

SHA512
e3928e509d852ae8f62b6378f984013345ddff9f5073e77323703acf20ca44bebff1753f09e7343cd948559bcafe766edce38e767efc5e7e7a5fd42c37be2e13

Download Submit
C:\Users\Admin\AppData\Local\Turbo.net\Sandbox\Notepad++\7.55\xsandbox.bin

Filesize
16B

MD5
ec3d19e8e9b05d025cb56c2a98ead8e7

SHA1
748532edeb86496c8efe5e2327501d89ec1f13df

SHA256
edb7be3ef6098a1e24d0c72bbc6f968dea773951a0dd07b63bad6d9009ae3bf4

SHA512
175fb8432472b6795bb5db0eba61bc7b57331720825df5b048f3086815ba844df4f7e83e42ff9e8fe5ab01700675a774cb916677953d6e0088ffbf1fa2775349

Download Submit
memory/3056-23-0x0000000010000000-0x000000001006A000-memory.dmp

Filesize
424KB

Download
memory/3056-10-0x0000000000A90000-0x0000000000DDA000-memory.dmp

Filesize
3.3MB

Download
memory/3056-24-0x0000000010000000-0x000000001006A000-memory.dmp

Filesize
424KB

Download
memory/3056-8-0x0000000000A90000-0x0000000000DDA000-memory.dmp

Filesize
3.3MB

Download
memory/3056-25-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3056-15-0x0000000000A90000-0x0000000000DDA000-memory.dmp

Filesize
3.3MB

Download
memory/3056-17-0x0000000000A90000-0x0000000000DDA000-memory.dmp

Filesize
3.3MB

Download
memory/3056-37-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3056-13-0x0000000000A90000-0x0000000000DDA000-memory.dmp

Filesize
3.3MB

Download
memory/3056-12-0x0000000000A90000-0x0000000000DDA000-memory.dmp

Filesize
3.3MB

Download
memory/3056-5-0x0000000000A90000-0x0000000000DDA000-memory.dmp

Filesize
3.3MB

Download
memory/3056-18-0x0000000010000000-0x000000001006A000-memory.dmp

Filesize
424KB

Download
memory/3056-9-0x0000000000A90000-0x0000000000DDA000-memory.dmp

Filesize
3.3MB

Download
memory/3056-11-0x0000000000A90000-0x0000000000DDA000-memory.dmp

Filesize
3.3MB

Download
memory/3056-14-0x0000000000A90000-0x0000000000DDA000-memory.dmp

Filesize
3.3MB

Download
memory/3056-36-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3056-38-0x0000000010000000-0x000000001006A000-memory.dmp

Filesize
424KB

Download
memory/3056-35-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3056-34-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3056-6-0x0000000077410000-0x0000000077411000-memory.dmp

Filesize
4KB

Download
memory/3056-39-0x0000000000A90000-0x0000000000DDA000-memory.dmp

Filesize
3.3MB

Download
memory/3056-40-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/3056-7-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/3056-42-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3056-43-0x0000000000A90000-0x0000000000DDA000-memory.dmp

Filesize
3.3MB

Download