azorult | 33b93777f0db8c195d9a9e52c7442bd98376cfcac4d929912dc6155cdcfd550e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

304dcc445a88ebbe5f929d7c2e546146_JaffaCakes118.exe
Size

344KB
MD5

304dcc445a88ebbe5f929d7c2e546146
SHA1

2e1313071984c8a73997778962cbacc2ff8d8efd
SHA256

33b93777f0db8c195d9a9e52c7442bd98376cfcac4d929912dc6155cdcfd550e
SHA512

4c458bf109a06bf382bca765c2181c15758fd6921d4192d9ee660707ca5eefdb68b1bb5fd028755f33cc1628c0630572ada0d8c258f411c366def8d31c67b4d0
SSDEEP

6144:7bjy2rtepz+IIuN3cg7O8P2TAOjKYmS1jdfhSf21a/qE6I:7bW3PIuNR7v+T4DS1dhSf2UyE6I

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://195.245.112.115/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

304dcc445a88ebbe5f929d7c2e546146_JaffaCakes118.exe

description	pid	process	target process
PID 2756 set thread context of 2476	2756	304dcc445a88ebbe5f929d7c2e546146_JaffaCakes118.exe	304dcc445a88ebbe5f929d7c2e546146_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

304dcc445a88ebbe5f929d7c2e546146_JaffaCakes118.exe

pid	process
2756	304dcc445a88ebbe5f929d7c2e546146_JaffaCakes118.exe
2756	304dcc445a88ebbe5f929d7c2e546146_JaffaCakes118.exe
2756	304dcc445a88ebbe5f929d7c2e546146_JaffaCakes118.exe
2756	304dcc445a88ebbe5f929d7c2e546146_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

304dcc445a88ebbe5f929d7c2e546146_JaffaCakes118.exe

pid process

2756 304dcc445a88ebbe5f929d7c2e546146_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

304dcc445a88ebbe5f929d7c2e546146_JaffaCakes118.exe

description	pid	process	target process
PID 2756 wrote to memory of 2476	2756	304dcc445a88ebbe5f929d7c2e546146_JaffaCakes118.exe	304dcc445a88ebbe5f929d7c2e546146_JaffaCakes118.exe
PID 2756 wrote to memory of 2476	2756	304dcc445a88ebbe5f929d7c2e546146_JaffaCakes118.exe	304dcc445a88ebbe5f929d7c2e546146_JaffaCakes118.exe
PID 2756 wrote to memory of 2476	2756	304dcc445a88ebbe5f929d7c2e546146_JaffaCakes118.exe	304dcc445a88ebbe5f929d7c2e546146_JaffaCakes118.exe
PID 2756 wrote to memory of 2476	2756	304dcc445a88ebbe5f929d7c2e546146_JaffaCakes118.exe	304dcc445a88ebbe5f929d7c2e546146_JaffaCakes118.exe
PID 2756 wrote to memory of 2476	2756	304dcc445a88ebbe5f929d7c2e546146_JaffaCakes118.exe	304dcc445a88ebbe5f929d7c2e546146_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\304dcc445a88ebbe5f929d7c2e546146_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\304dcc445a88ebbe5f929d7c2e546146_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2756

C:\Users\Admin\AppData\Local\Temp\304dcc445a88ebbe5f929d7c2e546146_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\304dcc445a88ebbe5f929d7c2e546146_JaffaCakes118.exe"
2⤵
PID:2476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2476-23-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2476-24-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2756-12-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2756-20-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2756-11-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2756-19-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2756-18-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2756-17-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2756-16-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2756-15-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2756-10-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2756-13-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2756-1-0x0000000000250000-0x0000000000350000-memory.dmp

Filesize
1024KB

Download
memory/2756-21-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2756-14-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2756-9-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2756-8-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2756-7-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2756-6-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2756-5-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2756-4-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2756-3-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2756-22-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2756-2-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download