Overview

overview

10

Static

static

3

1d14c938c3...18.exe

windows7-x64

10

1d14c938c3...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06-05-2024 15:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1d14c938c3dc37a1e53ffa556b22d177_JaffaCakes118.exe

  • Size

    1.0MB

  • MD5

    1d14c938c3dc37a1e53ffa556b22d177

  • SHA1

    d212b0d999e33da5994d3966e4bcbb369b1c7289

  • SHA256

    fccc12ba866c71644e8d877c8780ee0ba0178c1712b3c05f957f90f59de6d493

  • SHA512

    816370cd07c7c04fd6a113c2ebb8fa878d7b4df186101e5bd337bc1f931c292d9d72c7cd6c2895c17be612c79d5ab5a56a848407a8072a25f2817f98c1bac176

  • SSDEEP

    12288:K5Ar24e2MaUYo2TVXsdSY7h02P9e1BSPjY7o5B/hlG4sPY0dye3AaQYeFaotTQpv:K5Q7v+7h02Pg+M74HGfIaQ6rei

Score
10/10
azorultoskiraccoond58ee081e4d259676e5c18189c82f5356e64ec30infostealerspywarestealertrojan

Malware Config

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Extracted

Family

raccoon

Botnet

d58ee081e4d259676e5c18189c82f5356e64ec30

Attributes
  • url4cnc

    https://telete.in/brikitiki

rc4.plain
rc4.plain

Extracted

Family

oski

C2

courtneysdv.ac.ug

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

    infostealeroski
  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon
  • Raccoon Stealer V1 payload 4 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1d14c938c3dc37a1e53ffa556b22d177_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1d14c938c3dc37a1e53ffa556b22d177_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Users\Admin\AppData\Local\Temp\CVhffgrdDFbv.exe
      "C:\Users\Admin\AppData\Local\Temp\CVhffgrdDFbv.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2064
      • C:\Users\Admin\AppData\Local\Temp\CVhffgrdDFbv.exe
        "C:\Users\Admin\AppData\Local\Temp\CVhffgrdDFbv.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        PID:2644
    • C:\Users\Admin\AppData\Local\Temp\zVhgfgjbnv.exe
      "C:\Users\Admin\AppData\Local\Temp\zVhgfgjbnv.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2544
      • C:\Users\Admin\AppData\Local\Temp\zVhgfgjbnv.exe
        "C:\Users\Admin\AppData\Local\Temp\zVhgfgjbnv.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of WriteProcessMemory
        PID:2484
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 872
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:240
    • C:\Users\Admin\AppData\Local\Temp\1d14c938c3dc37a1e53ffa556b22d177_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\1d14c938c3dc37a1e53ffa556b22d177_JaffaCakes118.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      PID:2660

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\CVhffgrdDFbv.exe
    Filesize

    232KB

    MD5

    02a3dc4aeb09f2d0c48a47922bed2d73

    SHA1

    ad59fb3b77bb02a2a38ddba31d617b17eeffb276

    SHA256

    4a2d4f9ed9d34ba93219ad56c5d20902b89ecf8541afde59d1c321e0784f3b57

    SHA512

    22bab6e49b3528b8e74b943c70541b1fbf4eb5b0d57924bf4bf4ae461fd5253e1d6ea3b7b1aff9263f1175d059c8daa4cb6236e869a16b2e585cc0ebe58f9e06

    Download Submit
  • \Users\Admin\AppData\Local\Temp\zVhgfgjbnv.exe
    Filesize

    276KB

    MD5

    3353c49b01e245c14103afb71443c724

    SHA1

    9d51ca208eb1d2d7e0b9bbd399af7e17bfcb2e97

    SHA256

    29fc25aa5e1cae33ce7df5819cb4cd586784828039f4cda5b4f16583cf92a2d6

    SHA512

    a636f77352ccf2a52778631f2c43365290ae9a7da8e686c28ebe259c63f910269b9f0df5d0595cd46d25f9aa64c84c6423e596fc771ef4c9e024be75448b50df

    Download Submit
  • memory/2064-16-0x0000000000230000-0x0000000000231000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2064-37-0x0000000000240000-0x0000000000247000-memory.dmp
    Filesize

    28KB

    Download
  • memory/2064-19-0x0000000000240000-0x0000000000247000-memory.dmp
    Filesize

    28KB

    Download
  • memory/2104-2-0x0000000000240000-0x0000000000241000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2104-25-0x0000000003250000-0x0000000003257000-memory.dmp
    Filesize

    28KB

    Download
  • memory/2484-59-0x0000000000400000-0x0000000000434000-memory.dmp
    Filesize

    208KB

    Download
  • memory/2484-50-0x0000000000400000-0x0000000000438000-memory.dmp
    Filesize

    224KB

    Download
  • memory/2484-48-0x0000000000400000-0x0000000000438000-memory.dmp
    Filesize

    224KB

    Download
  • memory/2544-35-0x0000000000240000-0x0000000000247000-memory.dmp
    Filesize

    28KB

    Download
  • memory/2644-30-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

    Download
  • memory/2644-46-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

    Download
  • memory/2644-47-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

    Download
  • memory/2644-38-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

    Download
  • memory/2644-33-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

    Download
  • memory/2644-36-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

    Download
  • memory/2660-41-0x0000000000400000-0x0000000000497000-memory.dmp
    Filesize

    604KB

    Download
  • memory/2660-39-0x0000000000400000-0x0000000000497000-memory.dmp
    Filesize

    604KB

    Download
  • memory/2660-43-0x0000000000400000-0x0000000000493000-memory.dmp
    Filesize

    588KB

    Download
  • memory/2660-58-0x0000000000400000-0x0000000000493000-memory.dmp
    Filesize

    588KB

    Download