azorult | b7d284088c1c67768fbc8e337c6670bc96584ebf63015a7285353f1a39234954

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2024 07:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbcc60e72ff12749191fbe0f9b1536ad_JaffaCakes118.exe
Size

560KB
MD5

fbcc60e72ff12749191fbe0f9b1536ad
SHA1

4356484a628bfc29e3de4b2b6b667de9e05be591
SHA256

b7d284088c1c67768fbc8e337c6670bc96584ebf63015a7285353f1a39234954
SHA512

ca0015617ad18ea02dd39020ba23ce7fffea461186fd6b9f0cc48f393b02b993dc33ec2e5f2ad235075b3852493481a91ab2938940da8864fd22b73a275552f5
SSDEEP

12288:8h1Lk70Tnvjc286/WS6gmGlMcgjyd5z/9jnQn2XeLDNSQP90z+Q:Ik70Trc28PhyHnEtLdyqQ

Score

10^/10

azorult discovery infostealer trojan

Malware Config

Extracted

Family

azorult

http://195.245.112.115/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4688 set thread context of 936	4688	fbcc60e72ff12749191fbe0f9b1536ad_JaffaCakes118.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4196	936	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fbcc60e72ff12749191fbe0f9b1536ad_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fbcc60e72ff12749191fbe0f9b1536ad_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 936	4688	fbcc60e72ff12749191fbe0f9b1536ad_JaffaCakes118.exe	82
PID 4688 wrote to memory of 936	4688	fbcc60e72ff12749191fbe0f9b1536ad_JaffaCakes118.exe	82
PID 4688 wrote to memory of 936	4688	fbcc60e72ff12749191fbe0f9b1536ad_JaffaCakes118.exe	82
PID 4688 wrote to memory of 936	4688	fbcc60e72ff12749191fbe0f9b1536ad_JaffaCakes118.exe	82
PID 4688 wrote to memory of 936	4688	fbcc60e72ff12749191fbe0f9b1536ad_JaffaCakes118.exe	82
PID 4688 wrote to memory of 936	4688	fbcc60e72ff12749191fbe0f9b1536ad_JaffaCakes118.exe	82
PID 4688 wrote to memory of 936	4688	fbcc60e72ff12749191fbe0f9b1536ad_JaffaCakes118.exe	82
PID 4688 wrote to memory of 936	4688	fbcc60e72ff12749191fbe0f9b1536ad_JaffaCakes118.exe	82
PID 4688 wrote to memory of 936	4688	fbcc60e72ff12749191fbe0f9b1536ad_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\fbcc60e72ff12749191fbe0f9b1536ad_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fbcc60e72ff12749191fbe0f9b1536ad_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Users\Admin\AppData\Local\Temp\fbcc60e72ff12749191fbe0f9b1536ad_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\fbcc60e72ff12749191fbe0f9b1536ad_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 1304
    3⤵
    - Program crash
    PID:4196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 936 -ip 936
1⤵
PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/936-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/936-16-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/936-15-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/936-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4688-3-0x0000000004E90000-0x0000000005434000-memory.dmp

Filesize
5.6MB

Download
memory/4688-5-0x0000000075110000-0x00000000758C0000-memory.dmp

Filesize
7.7MB

Download
memory/4688-6-0x0000000005440000-0x00000000054DC000-memory.dmp

Filesize
624KB

Download
memory/4688-4-0x0000000004D80000-0x0000000004DF8000-memory.dmp

Filesize
480KB

Download
memory/4688-11-0x0000000002810000-0x0000000002828000-memory.dmp

Filesize
96KB

Download
memory/4688-0-0x000000007511E000-0x000000007511F000-memory.dmp

Filesize
4KB

Download
memory/4688-7-0x00000000054E0000-0x000000000551C000-memory.dmp

Filesize
240KB

Download
memory/4688-13-0x0000000075110000-0x00000000758C0000-memory.dmp

Filesize
7.7MB

Download
memory/4688-2-0x0000000075110000-0x00000000758C0000-memory.dmp

Filesize
7.7MB

Download
memory/4688-14-0x0000000075110000-0x00000000758C0000-memory.dmp

Filesize
7.7MB

Download
memory/4688-1-0x0000000004CC0000-0x0000000004D38000-memory.dmp

Filesize
480KB

Download