azorult | 896c7582c90c506fb0c3fc69ed4e81266a47129f79682d89f76a5583c0113efa

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 05:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe
Size

246KB
MD5

a3eb085e4d161a609f5c035930564a74
SHA1

07d92e7b9b0ad8876e6d76ebf4605303af83148e
SHA256

896c7582c90c506fb0c3fc69ed4e81266a47129f79682d89f76a5583c0113efa
SHA512

2b41587b2861c5aea71944b10e85d48188fe0c87c9d08422afbf3c54fd71b59fa7915fb927066881611230b5a9fcd4f5984c1f06016afe6c598e058931a5798e
SSDEEP

6144:X1onigKGh8Y5oFVV0KgJUz0Y+Ol3Wh1s5/ifLWAIDeG:loicxmETOgs5/ifKDR

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://obsidian.bit/black/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Loads dropped DLL 1 IoCs

Processes:

a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe

pid process

2836 a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe

pid	process
2836	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe

Unexpected DNS network traffic destination 10 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	80.233.248.109
Destination IP	5.9.49.12
Destination IP	62.113.203.99
Destination IP	142.4.204.111
Destination IP	5.135.183.146
Destination IP	101.226.79.205
Destination IP	91.217.137.44
Destination IP	169.239.202.202
Destination IP	130.255.73.90
Destination IP	188.165.200.156

Suspicious use of SetThreadContext 1 IoCs

Processes:

a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe

description	pid	process	target process
PID 2836 set thread context of 2648	2836	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe

pid process

2836 a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe

pid	process
2836	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe

description	pid	process	target process
PID 2836 wrote to memory of 2648	2836	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe
PID 2836 wrote to memory of 2648	2836	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe
PID 2836 wrote to memory of 2648	2836	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe
PID 2836 wrote to memory of 2648	2836	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe
PID 2836 wrote to memory of 2648	2836	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe
PID 2836 wrote to memory of 2648	2836	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe
PID 2836 wrote to memory of 2648	2836	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe
PID 2836 wrote to memory of 2648	2836	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2836

C:\Users\Admin\AppData\Local\Temp\a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe"
2⤵
PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsi28E6.tmp\System.dll

Filesize
11KB

MD5
3f176d1ee13b0d7d6bd92e1c7a0b9bae

SHA1
fe582246792774c2c9dd15639ffa0aca90d6fd0b

SHA256
fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

SHA512
0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

Download Submit
memory/2648-8-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2648-11-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2648-12-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2648-13-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2648-14-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2836-7-0x00000000003E0000-0x00000000003FF000-memory.dmp

Filesize
124KB

Download
memory/2836-10-0x00000000003E0000-0x00000000003FF000-memory.dmp

Filesize
124KB

Download