azorult | a86dd3e06fc22b36fec7d577251ea051b38d02c95608a806895c34119769abf9

General

Target

86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe
Size

662KB
MD5

86bf66df2acbb1fb88db9b38c4dea746
SHA1

b67192f0268f1a9f24aa36ee3787f93192ffb194
SHA256

a86dd3e06fc22b36fec7d577251ea051b38d02c95608a806895c34119769abf9
SHA512

ccf63106c48e7257d9f42f210701477fdb5028f9cd89428085e18f3c11b89668200ebeb66bc9a743c968938f09aefd8a959b0995a0a9aa982aceb44906108323
SSDEEP

12288:OpeV3CZrqhwjMLJ2R46pJEq/y6INX6LRgU7e96ptgzMYTmsZHwA+J:mUwQLJ2RHGq/wKgD6goYTfWzJ

Score

10^/10

azorult discovery infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://37.0.10.102/rut/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Azorult family
azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe

description	pid	process	target process
PID 1652 set thread context of 3984	1652	86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe	86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4832 3984 WerFault.exe 86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe

pid process

1652 86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe
1652 86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 1652 86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe

pid	pid_target	process	target process
4832	3984	WerFault.exe	86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe

pid	process
1652	86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe
1652	86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1652	86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe

description	pid	process	target process
PID 1652 wrote to memory of 3984	1652	86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe	86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe
PID 1652 wrote to memory of 3984	1652	86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe	86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe
PID 1652 wrote to memory of 3984	1652	86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe	86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe
PID 1652 wrote to memory of 3984	1652	86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe	86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe
PID 1652 wrote to memory of 3984	1652	86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe	86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe
PID 1652 wrote to memory of 3984	1652	86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe	86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe
PID 1652 wrote to memory of 3984	1652	86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe	86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe
PID 1652 wrote to memory of 3984	1652	86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe	86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe
PID 1652 wrote to memory of 3984	1652	86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe	86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\AppData\Local\Temp\86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\86bf66df2acbb1fb88db9b38c4dea746_JaffaCakes118.exe"
  2⤵
  PID:3984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 360
    3⤵
    - Program crash
    PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 3984 -ip 3984
1⤵
PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1652-6-0x0000000074BD0000-0x0000000075380000-memory.dmp

Filesize
7.7MB

Download
memory/1652-8-0x0000000074BD0000-0x0000000075380000-memory.dmp

Filesize
7.7MB

Download
memory/1652-2-0x0000000005EE0000-0x0000000006484000-memory.dmp

Filesize
5.6MB

Download
memory/1652-3-0x0000000005840000-0x00000000058D2000-memory.dmp

Filesize
584KB

Download
memory/1652-4-0x0000000005930000-0x0000000005C84000-memory.dmp

Filesize
3.3MB

Download
memory/1652-5-0x0000000005DC0000-0x0000000005E5C000-memory.dmp

Filesize
624KB

Download
memory/1652-1-0x0000000000F20000-0x0000000000FCC000-memory.dmp

Filesize
688KB

Download
memory/1652-7-0x0000000007370000-0x00000000073A8000-memory.dmp

Filesize
224KB

Download
memory/1652-0-0x0000000074BDE000-0x0000000074BDF000-memory.dmp

Filesize
4KB

Download
memory/1652-9-0x0000000005280000-0x0000000005294000-memory.dmp

Filesize
80KB

Download
memory/1652-10-0x00000000052B0000-0x00000000052B6000-memory.dmp

Filesize
24KB

Download
memory/1652-19-0x0000000074BD0000-0x0000000075380000-memory.dmp

Filesize
7.7MB

Download
memory/3984-14-0x0000000000610000-0x0000000000630000-memory.dmp

Filesize
128KB

Download
memory/3984-18-0x0000000000610000-0x0000000000630000-memory.dmp

Filesize
128KB

Download
memory/3984-13-0x0000000000610000-0x0000000000630000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing