azorult | 49b695f3657509f682b3f2af64f9350529aa2f21963517a4c555bbd2a5352226

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18-06-2024 08:15

Target

baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe
Size

322KB
MD5

baae78ebf646cf42abde7924793c978b
SHA1

a1a5f775a434c9be3495812424145b74d4da432f
SHA256

49b695f3657509f682b3f2af64f9350529aa2f21963517a4c555bbd2a5352226
SHA512

517e456985908b6eb4028d092e5b9e3fb708aeeb79ccbae59b8b1984a6ad5603157a05d98bb02e8c266fdd49524c5ea6dc16fbff6aef1ff0f301e701e8069386
SSDEEP

6144:l22hiKcXo8KMEHZwkeyYmlJ5KdsMH3soCzwyT8gca/ssuBL:ldhiJE5Eml/+Kz9u

Score

10^/10

Family

azorult

http://hise.us/petit/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe

description	pid	process	target process
PID 4364 set thread context of 3992	4364	baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe	baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

492 3992 WerFault.exe baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 4364 baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe

pid	pid_target	process	target process
492	3992	WerFault.exe	baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	4364	baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe

description	pid	process	target process
PID 4364 wrote to memory of 3992	4364	baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe	baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe
PID 4364 wrote to memory of 3992	4364	baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe	baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe
PID 4364 wrote to memory of 3992	4364	baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe	baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe
PID 4364 wrote to memory of 3992	4364	baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe	baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe
PID 4364 wrote to memory of 3992	4364	baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe	baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe
PID 4364 wrote to memory of 3992	4364	baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe	baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe
PID 4364 wrote to memory of 3992	4364	baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe	baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe
PID 4364 wrote to memory of 3992	4364	baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe	baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe
PID 4364 wrote to memory of 3992	4364	baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe	baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\baae78ebf646cf42abde7924793c978b_JaffaCakes118.exe"
2⤵
PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 360
3⤵
- Program crash
PID:492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3992 -ip 3992
1⤵
PID:4548

memory/3992-13-0x0000000000500000-0x0000000000520000-memory.dmp

Filesize
128KB

Download
memory/3992-11-0x0000000000500000-0x0000000000520000-memory.dmp

Filesize
128KB

Download
memory/3992-17-0x0000000000500000-0x0000000000520000-memory.dmp

Filesize
128KB

Download
memory/4364-6-0x00000000033D0000-0x00000000033DC000-memory.dmp

Filesize
48KB

Download
memory/4364-4-0x0000000074E60000-0x0000000075610000-memory.dmp

Filesize
7.7MB

Download
memory/4364-5-0x0000000005FC0000-0x0000000006564000-memory.dmp

Filesize
5.6MB

Download
memory/4364-0-0x0000000074E6E000-0x0000000074E6F000-memory.dmp

Filesize
4KB

Download
memory/4364-7-0x0000000074E6E000-0x0000000074E6F000-memory.dmp

Filesize
4KB

Download
memory/4364-8-0x0000000074E60000-0x0000000075610000-memory.dmp

Filesize
7.7MB

Download
memory/4364-9-0x0000000006810000-0x00000000068AC000-memory.dmp

Filesize
624KB

Download
memory/4364-3-0x0000000005970000-0x0000000005A02000-memory.dmp

Filesize
584KB

Download
memory/4364-2-0x00000000033A0000-0x00000000033C0000-memory.dmp

Filesize
128KB

Download
memory/4364-1-0x0000000000F00000-0x0000000000F56000-memory.dmp

Filesize
344KB

Download
memory/4364-18-0x0000000074E60000-0x0000000075610000-memory.dmp

Filesize
7.7MB

Download