azorult | 174cd7c62deae72cd44b810784557fb01bfdeeb9f6f537c6639d7307d1387a36

General

Target

9f83d83f808d4b51efad7c4e20d63c5b_JaffaCakes118.exe
Size

211KB
MD5

9f83d83f808d4b51efad7c4e20d63c5b
SHA1

9c53de6a8dbf7b89ccfc256c8e651b66624b52c1
SHA256

174cd7c62deae72cd44b810784557fb01bfdeeb9f6f537c6639d7307d1387a36
SHA512

139c56ad1545357fc65f6838fdddc7168046abec7117ea22f2ce2221ffb207eac088bbb2a2eb562b96ec041114d4b2aee889550f21cf648b817d7e634f539b91
SSDEEP

3072:PJbwzoUoTGAVuRvVv8+clo0mJxt+zPhWB8EhCybiSvdkNfWqQBV6SV4Payq17U4b:PazoUcAPcU64B8AbXWfWqQ77VH5yzPG

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2392 set thread context of 1344	2392	9f83d83f808d4b51efad7c4e20d63c5b_JaffaCakes118.exe	29

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2392	9f83d83f808d4b51efad7c4e20d63c5b_JaffaCakes118.exe
2392	9f83d83f808d4b51efad7c4e20d63c5b_JaffaCakes118.exe
2392	9f83d83f808d4b51efad7c4e20d63c5b_JaffaCakes118.exe
2392	9f83d83f808d4b51efad7c4e20d63c5b_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2392	9f83d83f808d4b51efad7c4e20d63c5b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 1344	2392	9f83d83f808d4b51efad7c4e20d63c5b_JaffaCakes118.exe	29
PID 2392 wrote to memory of 1344	2392	9f83d83f808d4b51efad7c4e20d63c5b_JaffaCakes118.exe	29
PID 2392 wrote to memory of 1344	2392	9f83d83f808d4b51efad7c4e20d63c5b_JaffaCakes118.exe	29
PID 2392 wrote to memory of 1344	2392	9f83d83f808d4b51efad7c4e20d63c5b_JaffaCakes118.exe	29
PID 2392 wrote to memory of 1344	2392	9f83d83f808d4b51efad7c4e20d63c5b_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\9f83d83f808d4b51efad7c4e20d63c5b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9f83d83f808d4b51efad7c4e20d63c5b_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Users\Admin\AppData\Local\Temp\9f83d83f808d4b51efad7c4e20d63c5b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\9f83d83f808d4b51efad7c4e20d63c5b_JaffaCakes118.exe"
  2⤵
  PID:1344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1344-33-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1344-34-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2392-20-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-4-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-32-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-31-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-30-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-29-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-17-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-27-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-26-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-25-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-24-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-23-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-22-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-21-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-12-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-19-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-28-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-16-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-15-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-14-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-13-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-2-0x0000000000300000-0x0000000000400000-memory.dmp

Filesize
1024KB

Download
memory/2392-11-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-10-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-9-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-8-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-7-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-6-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-5-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-18-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2392-3-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2392-1-0x00000000001F0000-0x00000000001F5000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing