azorult | 08fe1b52f9d2b76164cf910b62ea0509774cae293fb24d735c53ca5f76be8ff1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2024 00:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

680a16672a17dfdbdae661e74c20455b_JaffaCakes118.exe
Size

431KB
MD5

680a16672a17dfdbdae661e74c20455b
SHA1

4c0021b38f2a39085038cf530373deb688c4cb7e
SHA256

08fe1b52f9d2b76164cf910b62ea0509774cae293fb24d735c53ca5f76be8ff1
SHA512

7d4fd32e5077fe8b4d386100641a475e0cdb774507245707898d4d1ffd5813669be014bb77111a98f76536949cbfe3af050f41f14ed1dd011ea9114adf779c93
SSDEEP

6144:kc0h522p3l04ZMSmIp3Uy28uhyZsYRsq3+V0z2wJSubgmxyDug/vLDXW:Shxp3lZnT9bDiYRsq3+w26faP7q

Score

10^/10

azorult discovery execution infostealer trojan

Malware Config

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	680a16672a17dfdbdae661e74c20455b_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	font_updete.exe

Executes dropped EXE 11 IoCs

pid	Process
2924	font.exe
4360	font_updete.exe
5004	font_updete.exe
4152	font.exe
704	font.exe
4848	csrss.exe
2364	csrss.exe
3240	csrss.exe
3380	csrss.exe
2156	csrss.exe
3560	csrss.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4360 set thread context of 5004	4360	font_updete.exe	94
PID 2924 set thread context of 704	2924	font.exe	98
PID 4848 set thread context of 2364	4848	csrss.exe	105
PID 3240 set thread context of 3380	3240	csrss.exe	111
PID 2156 set thread context of 3560	2156	csrss.exe	123

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	680a16672a17dfdbdae661e74c20455b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	font.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	font_updete.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	font_updete.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	font.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	680a16672a17dfdbdae661e74c20455b_JaffaCakes118.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3300	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
5004	font_updete.exe
2364	csrss.exe
3380	csrss.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 2924	3120	680a16672a17dfdbdae661e74c20455b_JaffaCakes118.exe	84
PID 3120 wrote to memory of 2924	3120	680a16672a17dfdbdae661e74c20455b_JaffaCakes118.exe	84
PID 3120 wrote to memory of 2924	3120	680a16672a17dfdbdae661e74c20455b_JaffaCakes118.exe	84
PID 3120 wrote to memory of 4360	3120	680a16672a17dfdbdae661e74c20455b_JaffaCakes118.exe	87
PID 3120 wrote to memory of 4360	3120	680a16672a17dfdbdae661e74c20455b_JaffaCakes118.exe	87
PID 3120 wrote to memory of 4360	3120	680a16672a17dfdbdae661e74c20455b_JaffaCakes118.exe	87
PID 3120 wrote to memory of 3172	3120	680a16672a17dfdbdae661e74c20455b_JaffaCakes118.exe	88
PID 3120 wrote to memory of 3172	3120	680a16672a17dfdbdae661e74c20455b_JaffaCakes118.exe	88
PID 3120 wrote to memory of 3172	3120	680a16672a17dfdbdae661e74c20455b_JaffaCakes118.exe	88
PID 4360 wrote to memory of 5004	4360	font_updete.exe	94
PID 4360 wrote to memory of 5004	4360	font_updete.exe	94
PID 4360 wrote to memory of 5004	4360	font_updete.exe	94
PID 4360 wrote to memory of 5004	4360	font_updete.exe	94
PID 4360 wrote to memory of 5004	4360	font_updete.exe	94
PID 4360 wrote to memory of 5004	4360	font_updete.exe	94
PID 4360 wrote to memory of 5004	4360	font_updete.exe	94
PID 4360 wrote to memory of 5004	4360	font_updete.exe	94
PID 5004 wrote to memory of 3300	5004	font_updete.exe	95
PID 5004 wrote to memory of 3300	5004	font_updete.exe	95
PID 5004 wrote to memory of 3300	5004	font_updete.exe	95
PID 2924 wrote to memory of 4152	2924	font.exe	97
PID 2924 wrote to memory of 4152	2924	font.exe	97
PID 2924 wrote to memory of 4152	2924	font.exe	97
PID 2924 wrote to memory of 704	2924	font.exe	98
PID 2924 wrote to memory of 704	2924	font.exe	98
PID 2924 wrote to memory of 704	2924	font.exe	98
PID 2924 wrote to memory of 704	2924	font.exe	98
PID 2924 wrote to memory of 704	2924	font.exe	98
PID 2924 wrote to memory of 704	2924	font.exe	98
PID 2924 wrote to memory of 704	2924	font.exe	98
PID 2924 wrote to memory of 704	2924	font.exe	98
PID 2924 wrote to memory of 704	2924	font.exe	98
PID 2924 wrote to memory of 704	2924	font.exe	98
PID 4848 wrote to memory of 2364	4848	csrss.exe	105
PID 4848 wrote to memory of 2364	4848	csrss.exe	105
PID 4848 wrote to memory of 2364	4848	csrss.exe	105
PID 4848 wrote to memory of 2364	4848	csrss.exe	105
PID 4848 wrote to memory of 2364	4848	csrss.exe	105
PID 4848 wrote to memory of 2364	4848	csrss.exe	105
PID 4848 wrote to memory of 2364	4848	csrss.exe	105
PID 4848 wrote to memory of 2364	4848	csrss.exe	105
PID 3240 wrote to memory of 3380	3240	csrss.exe	111
PID 3240 wrote to memory of 3380	3240	csrss.exe	111
PID 3240 wrote to memory of 3380	3240	csrss.exe	111
PID 3240 wrote to memory of 3380	3240	csrss.exe	111
PID 3240 wrote to memory of 3380	3240	csrss.exe	111
PID 3240 wrote to memory of 3380	3240	csrss.exe	111
PID 3240 wrote to memory of 3380	3240	csrss.exe	111
PID 3240 wrote to memory of 3380	3240	csrss.exe	111
PID 2156 wrote to memory of 3560	2156	csrss.exe	123
PID 2156 wrote to memory of 3560	2156	csrss.exe	123
PID 2156 wrote to memory of 3560	2156	csrss.exe	123
PID 2156 wrote to memory of 3560	2156	csrss.exe	123
PID 2156 wrote to memory of 3560	2156	csrss.exe	123
PID 2156 wrote to memory of 3560	2156	csrss.exe	123
PID 2156 wrote to memory of 3560	2156	csrss.exe	123
PID 2156 wrote to memory of 3560	2156	csrss.exe	123

C:\Users\Admin\AppData\Local\Temp\680a16672a17dfdbdae661e74c20455b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\680a16672a17dfdbdae661e74c20455b_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Users\Admin\AppData\Local\Temp\font.exe
  "C:\Users\Admin\AppData\Local\Temp\font.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Users\Admin\AppData\Local\Temp\font.exe
    "C:\Users\Admin\AppData\Local\Temp\font.exe"
    3⤵
    - Executes dropped EXE
    PID:4152
- - C:\Users\Admin\AppData\Local\Temp\font.exe
    "C:\Users\Admin\AppData\Local\Temp\font.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:704
- C:\Users\Admin\AppData\Local\Temp\font_updete.exe
  "C:\Users\Admin\AppData\Local\Temp\font_updete.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Users\Admin\AppData\Local\Temp\font_updete.exe
    "C:\Users\Admin\AppData\Local\Temp\font_updete.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of WriteProcessMemory
    PID:5004
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Microsoft LocalManager [3747610554]" /f /tr "C:\ProgramData\{40153846-4015-4015-401538466106}\csrss.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3300
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\del.js"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3172

C:\ProgramData\{40153846-4015-4015-401538466106}\csrss.exe
C:\ProgramData\{40153846-4015-4015-401538466106}\csrss.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4848
- C:\ProgramData\{40153846-4015-4015-401538466106}\csrss.exe
  "C:\ProgramData\{40153846-4015-4015-401538466106}\csrss.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2364

C:\ProgramData\{40153846-4015-4015-401538466106}\csrss.exe
C:\ProgramData\{40153846-4015-4015-401538466106}\csrss.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3240
- C:\ProgramData\{40153846-4015-4015-401538466106}\csrss.exe
  "C:\ProgramData\{40153846-4015-4015-401538466106}\csrss.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3380

C:\ProgramData\{40153846-4015-4015-401538466106}\csrss.exe
C:\ProgramData\{40153846-4015-4015-401538466106}\csrss.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2156
- C:\ProgramData\{40153846-4015-4015-401538466106}\csrss.exe
  "C:\ProgramData\{40153846-4015-4015-401538466106}\csrss.exe"
  2⤵
  - Executes dropped EXE
  PID:3560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\del.js

Filesize
353B

MD5
ea81e86b8789733d2bb67fc045b564be

SHA1
3d5b074956899db98fe0ae1692579d7d9b3b9b63

SHA256
c5d807bcc4ad94a844c2e08f24a7f0226a013f9ad5297b18c9228ef8fd4a809d

SHA512
c917913235fe48001f0c18f135478802118803eaeb7b1eabd00447f8e49c68525cfac327f65adc59616b6c06ee020ca520cd23d0204ad95de55aad26ab2b948d

Download Submit
C:\Users\Admin\AppData\Local\Temp\font.exe

Filesize
192KB

MD5
d0185e9d9595791c12a9c125852cb14b

SHA1
61a35df4e9d2d371ba191f0a80c6f52f0c90d685

SHA256
bca071ef53327542fab35db8991dd90678e35976d9fa138b4a5a8c59b8aec994

SHA512
32f770c5523ffdd179c80e13e7b65b0f213aab3afd5b060daa41277d750fb91e8edfa92b7d04d1897dde214f64bb6fba2ce60a0805d560aa8a8913e52495f1fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\font_updete.exe

Filesize
175KB

MD5
0488f31c3ed5a382d0507937e1ab5df4

SHA1
59c4e79e05ff480cbde4b17448334438033ed310

SHA256
064196dbcc10306b0aa58d2d26e494b49d4b73a22faa3285bd7b00a2824e40c5

SHA512
1b7ef19b2ecd35524ea5dba7c290d9af52a6db162a75d4d1b4d5580648965e00a47a493b1031a925690cd6c0b11307ef8ecac85fd89ea135da10b6307d8d7680

Download Submit
memory/704-31-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/704-33-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2364-38-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3380-42-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3560-46-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5004-23-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5004-25-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5004-26-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5004-27-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads