azorult | dd860b1b9612e733d8f0985148b1f47cd9361243ccb729c3b6c3c2280461e157

Analysis

max time kernel
141s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-06-2024 00:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba4048bd09b860638952397c4bf83eeb_JaffaCakes118.exe
Size

7.4MB
MD5

ba4048bd09b860638952397c4bf83eeb
SHA1

7d0b68938d8bed360310d4b6a1d90112640b832a
SHA256

dd860b1b9612e733d8f0985148b1f47cd9361243ccb729c3b6c3c2280461e157
SHA512

7666bc99fec316f2d053d39cf64a3ad9dcc7487edfa9926d63b8a0dc89fcdfc1208d3d983c90cf1c83bcaaba86166b1af7c2bb6172941dc10c62965f24338a89
SSDEEP

196608:+jAIMBqN2/6NgE3aIOGW5ueQvD5LHMY8QU4PzETeS:+jMBqNX3leQvFmQU4L0d

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://195.245.112.115/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Executes dropped EXE 1 IoCs

Processes:

qwerty.exe

pid process

2832 qwerty.exe

pid	process
2832	qwerty.exe

Loads dropped DLL 8 IoCs

Processes:

ba4048bd09b860638952397c4bf83eeb_JaffaCakes118.exeWerFault.exe

pid	process
2664	ba4048bd09b860638952397c4bf83eeb_JaffaCakes118.exe
2664	ba4048bd09b860638952397c4bf83eeb_JaffaCakes118.exe
2664	ba4048bd09b860638952397c4bf83eeb_JaffaCakes118.exe
2664	ba4048bd09b860638952397c4bf83eeb_JaffaCakes118.exe
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

qwerty.exe

pid process

2832 qwerty.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2560 2832 WerFault.exe qwerty.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

qwerty.exe

pid process

2832 qwerty.exe

pid	process
2832	qwerty.exe

pid	pid_target	process	target process
2560	2832	WerFault.exe	qwerty.exe

pid	process
2832	qwerty.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ba4048bd09b860638952397c4bf83eeb_JaffaCakes118.exeqwerty.exe

description	pid	process	target process
PID 2664 wrote to memory of 2832	2664	ba4048bd09b860638952397c4bf83eeb_JaffaCakes118.exe	qwerty.exe
PID 2664 wrote to memory of 2832	2664	ba4048bd09b860638952397c4bf83eeb_JaffaCakes118.exe	qwerty.exe
PID 2664 wrote to memory of 2832	2664	ba4048bd09b860638952397c4bf83eeb_JaffaCakes118.exe	qwerty.exe
PID 2664 wrote to memory of 2832	2664	ba4048bd09b860638952397c4bf83eeb_JaffaCakes118.exe	qwerty.exe
PID 2832 wrote to memory of 2560	2832	qwerty.exe	WerFault.exe
PID 2832 wrote to memory of 2560	2832	qwerty.exe	WerFault.exe
PID 2832 wrote to memory of 2560	2832	qwerty.exe	WerFault.exe
PID 2832 wrote to memory of 2560	2832	qwerty.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ba4048bd09b860638952397c4bf83eeb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ba4048bd09b860638952397c4bf83eeb_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664

C:\Users\Admin\AppData\Local\Temp\RarSFX0\qwerty.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\qwerty.exe"
2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 832
3⤵
- Loads dropped DLL
- Program crash
PID:2560

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\qwerty.exe
Filesize
960KB

MD5
6539c93ba82b568ecc558ae1d18f5228

SHA1
ba820679e051c87b939c2888cd8e9e24f529173a

SHA256
5ca3f43e97cfbcb135804e430fc88f7d26287d924514b34b8ec11159e1c36fcf

SHA512
27efe64e1065b4814fc20b4b994762f80ed327ded1c4a65cfde1627b54322792c640e4e71b61afb2e32163b24acb7516911c861439224ca6c1d01ad22453aa17

Download Submit
memory/2664-18-0x0000000004070000-0x00000000043F4000-memory.dmp

Filesize
3.5MB

Download
memory/2664-21-0x0000000004070000-0x00000000043F4000-memory.dmp

Filesize
3.5MB

Download
memory/2664-19-0x0000000004070000-0x00000000043F4000-memory.dmp

Filesize
3.5MB

Download
memory/2664-29-0x0000000004070000-0x00000000043F4000-memory.dmp

Filesize
3.5MB

Download
memory/2832-20-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/2832-27-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download