azorult | dc472da1c1c3abca694aebb1dc27bd2b7ae224119ee9fcd1caffd9305e9b20fa

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2024 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe5429ab64a74a0d6f36d3ffb384e807_JaffaCakes118.exe
Size

202KB
MD5

fe5429ab64a74a0d6f36d3ffb384e807
SHA1

a4036eee39637f6722d94299f4e0aab90e7a3305
SHA256

dc472da1c1c3abca694aebb1dc27bd2b7ae224119ee9fcd1caffd9305e9b20fa
SHA512

878f3d825c6d6e5a1e6057e35ae9cf21640352c1d2ef3d94c6b7d1a985936d420fdcfc4a73a418df54c1440b5c7c66baa77cd674705ff69603146021fe2bcdcd
SSDEEP

3072:UYhLT4Wqg5yXSIUy4ZTmEneHzrqzBC4aT56Im8vwQjULhaqgVm:1hn4I1TZiSiqzraT5g8vwQjU9Lg

Score

10^/10

azorult discovery infostealer trojan

Malware Config

Extracted

Family

azorult

http://185.178.46.120/p/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2660 3020 WerFault.exe fe5429ab64a74a0d6f36d3ffb384e807_JaffaCakes118.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

fe5429ab64a74a0d6f36d3ffb384e807_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fe5429ab64a74a0d6f36d3ffb384e807_JaffaCakes118.exe

pid	pid_target	process	target process
2660	3020	WerFault.exe	fe5429ab64a74a0d6f36d3ffb384e807_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe5429ab64a74a0d6f36d3ffb384e807_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fe5429ab64a74a0d6f36d3ffb384e807_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe5429ab64a74a0d6f36d3ffb384e807_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 1432
  2⤵
  - Program crash
  PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3020 -ip 3020
1⤵
PID:512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3020-1-0x0000000000710000-0x0000000000810000-memory.dmp

Filesize
1024KB

Download
memory/3020-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3020-3-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/3020-4-0x0000000000710000-0x0000000000810000-memory.dmp

Filesize
1024KB

Download
memory/3020-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3020-7-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/3020-9-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/3020-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download