azorult | 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-05-2024 04:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
Size

749KB
MD5

531c89746f1bb6333331ad28cee32f13
SHA1

4eb7657831ef51aa2e11b40be9f1ed8933e04f28
SHA256

8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48
SHA512

f687f7fb4fdce0df9c19e34f65bc89da2a32126882aa584b138aede3e2d4a6dbb6814d47b17a29e469550c3c3aa6d5fc612f78fbe2ad47b1bb3f50b330d4358a
SSDEEP

12288:E10aMyM86BqwLdltr3gHE1PZlsz/XYzaXe1pW3VONQIeJe0Dtlqse/P3rqQn:E10aMt86B5btr3g1zQ91pWFABovf6

Score

10^/10

azorult oski raccoon 236c7f8a01d741b888dc6b6209805e66d41e62ba infostealer spyware stealer trojan

Malware Config

Extracted

Family

raccoon

Botnet

236c7f8a01d741b888dc6b6209805e66d41e62ba

Attributes

url4cnc
https://telete.in/brikitiki

rc4.plain

Extracted

Family

oski

nadia.ac.ug

Extracted

Family

azorult

http://195.245.112.115/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2660-21-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon_v1
behavioral1/memory/2660-19-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon_v1
behavioral1/memory/2660-16-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon_v1
behavioral1/memory/2660-15-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon_v1

Executes dropped EXE 4 IoCs

Processes:

ooo.exeooo.exeaaa.exeaaa.exe

pid process

2672 ooo.exe
1952 ooo.exe
1360 aaa.exe
2508 aaa.exe
Loads dropped DLL 9 IoCs

Processes:

WScript.exeooo.exeWScript.exeaaa.exeWerFault.exe

pid process

2628 WScript.exe
2672 ooo.exe
2468 WScript.exe
1360 aaa.exe
2260 WerFault.exe
2260 WerFault.exe
2260 WerFault.exe
2260 WerFault.exe
2260 WerFault.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2672	ooo.exe
1952	ooo.exe
1360	aaa.exe
2508	aaa.exe

pid	process
2628	WScript.exe
2672	ooo.exe
2468	WScript.exe
1360	aaa.exe
2260	WerFault.exe
2260	WerFault.exe
2260	WerFault.exe
2260	WerFault.exe
2260	WerFault.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exeooo.exeaaa.exe

description	pid	process	target process
PID 2324 set thread context of 2660	2324	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
PID 2672 set thread context of 1952	2672	ooo.exe	ooo.exe
PID 1360 set thread context of 2508	1360	aaa.exe	aaa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2808 2660 WerFault.exe 531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
2260 1952 WerFault.exe ooo.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exeooo.exeaaa.exe

pid process

2324 531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
2324 531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
2672 ooo.exe
2672 ooo.exe
1360 aaa.exe
1360 aaa.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exeooo.exeaaa.exe

description pid process

Token: SeDebugPrivilege 2324 531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
Token: SeDebugPrivilege 2672 ooo.exe
Token: SeDebugPrivilege 1360 aaa.exe

pid	pid_target	process	target process
2808	2660	WerFault.exe	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
2260	1952	WerFault.exe	ooo.exe

pid	process
2324	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
2324	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
2672	ooo.exe
2672	ooo.exe
1360	aaa.exe
1360	aaa.exe

description	pid	process
Token: SeDebugPrivilege	2324	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
Token: SeDebugPrivilege	2672	ooo.exe
Token: SeDebugPrivilege	1360	aaa.exe

Suspicious use of WriteProcessMemory 54 IoCs

Processes:

531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exeWScript.exeooo.exeWScript.exeaaa.exeooo.exe

description	pid	process	target process
PID 2324 wrote to memory of 2628	2324	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	WScript.exe
PID 2324 wrote to memory of 2628	2324	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	WScript.exe
PID 2324 wrote to memory of 2628	2324	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	WScript.exe
PID 2324 wrote to memory of 2628	2324	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	WScript.exe
PID 2324 wrote to memory of 2660	2324	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
PID 2324 wrote to memory of 2660	2324	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
PID 2324 wrote to memory of 2660	2324	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
PID 2324 wrote to memory of 2660	2324	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
PID 2324 wrote to memory of 2660	2324	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
PID 2324 wrote to memory of 2660	2324	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
PID 2324 wrote to memory of 2660	2324	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
PID 2324 wrote to memory of 2660	2324	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
PID 2324 wrote to memory of 2660	2324	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
PID 2324 wrote to memory of 2660	2324	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
PID 2660 wrote to memory of 2808	2660	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	WerFault.exe
PID 2660 wrote to memory of 2808	2660	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	WerFault.exe
PID 2660 wrote to memory of 2808	2660	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	WerFault.exe
PID 2660 wrote to memory of 2808	2660	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	WerFault.exe
PID 2628 wrote to memory of 2672	2628	WScript.exe	ooo.exe
PID 2628 wrote to memory of 2672	2628	WScript.exe	ooo.exe
PID 2628 wrote to memory of 2672	2628	WScript.exe	ooo.exe
PID 2628 wrote to memory of 2672	2628	WScript.exe	ooo.exe
PID 2672 wrote to memory of 2468	2672	ooo.exe	WScript.exe
PID 2672 wrote to memory of 2468	2672	ooo.exe	WScript.exe
PID 2672 wrote to memory of 2468	2672	ooo.exe	WScript.exe
PID 2672 wrote to memory of 2468	2672	ooo.exe	WScript.exe
PID 2672 wrote to memory of 1952	2672	ooo.exe	ooo.exe
PID 2672 wrote to memory of 1952	2672	ooo.exe	ooo.exe
PID 2672 wrote to memory of 1952	2672	ooo.exe	ooo.exe
PID 2672 wrote to memory of 1952	2672	ooo.exe	ooo.exe
PID 2672 wrote to memory of 1952	2672	ooo.exe	ooo.exe
PID 2672 wrote to memory of 1952	2672	ooo.exe	ooo.exe
PID 2672 wrote to memory of 1952	2672	ooo.exe	ooo.exe
PID 2672 wrote to memory of 1952	2672	ooo.exe	ooo.exe
PID 2672 wrote to memory of 1952	2672	ooo.exe	ooo.exe
PID 2672 wrote to memory of 1952	2672	ooo.exe	ooo.exe
PID 2468 wrote to memory of 1360	2468	WScript.exe	aaa.exe
PID 2468 wrote to memory of 1360	2468	WScript.exe	aaa.exe
PID 2468 wrote to memory of 1360	2468	WScript.exe	aaa.exe
PID 2468 wrote to memory of 1360	2468	WScript.exe	aaa.exe
PID 1360 wrote to memory of 2508	1360	aaa.exe	aaa.exe
PID 1360 wrote to memory of 2508	1360	aaa.exe	aaa.exe
PID 1360 wrote to memory of 2508	1360	aaa.exe	aaa.exe
PID 1360 wrote to memory of 2508	1360	aaa.exe	aaa.exe
PID 1360 wrote to memory of 2508	1360	aaa.exe	aaa.exe
PID 1360 wrote to memory of 2508	1360	aaa.exe	aaa.exe
PID 1360 wrote to memory of 2508	1360	aaa.exe	aaa.exe
PID 1360 wrote to memory of 2508	1360	aaa.exe	aaa.exe
PID 1360 wrote to memory of 2508	1360	aaa.exe	aaa.exe
PID 1360 wrote to memory of 2508	1360	aaa.exe	aaa.exe
PID 1952 wrote to memory of 2260	1952	ooo.exe	WerFault.exe
PID 1952 wrote to memory of 2260	1952	ooo.exe	WerFault.exe
PID 1952 wrote to memory of 2260	1952	ooo.exe	WerFault.exe
PID 1952 wrote to memory of 2260	1952	ooo.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Jwoasxr.vbs"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628

C:\Users\Admin\AppData\Local\Temp\ooo.exe
"C:\Users\Admin\AppData\Local\Temp\ooo.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Gsgxeo.vbs"
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468

C:\Users\Admin\AppData\Local\Temp\aaa.exe
"C:\Users\Admin\AppData\Local\Temp\aaa.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360

C:\Users\Admin\AppData\Local\Temp\aaa.exe
"C:\Users\Admin\AppData\Local\Temp\aaa.exe"
6⤵
- Executes dropped EXE
PID:2508

C:\Users\Admin\AppData\Local\Temp\ooo.exe
"C:\Users\Admin\AppData\Local\Temp\ooo.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 756
5⤵
- Loads dropped DLL
- Program crash
PID:2260

C:\Users\Admin\AppData\Local\Temp\531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 184
3⤵
- Program crash
PID:2808

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Gsgxeo.vbs
Filesize
91B

MD5
9e77c5f012c8e5ac0f5706f2a906ab6e

SHA1
900598d4cc26f03b37794e4b1f9de7e49cd94ee5

SHA256
d9f14c1c8a8aebed3afdfe07c1243d1b2b1ca4772ef66b902586691327944e38

SHA512
5ee472ea553af3c598f87db7ed1c8ebacd03b4b00c442ca50cb9f6e87488be5eb1e85aec0ea55cbe6c0234b21eddeb8a358bfc66e70be6d22603793ea99ee839

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jwoasxr.vbs
Filesize
91B

MD5
c0c64a797ebd363385bb9670d99054fe

SHA1
055d06d6d514bb5742f72829e5e1748282715094

SHA256
569e18bc2c6d7618e9c7e34e8b6ef116d543ec35b23414d2c2e5a4c84d471409

SHA512
39d4785622cdf99161792aa1cee81b42e4079a9d393906a6796854461a77428c016f624e031c1f3a4cf9d2a347bfcd9b70f709bb32a4d0ddb15027dacb084235

Download Submit
C:\Users\Admin\AppData\Local\Temp\ooo.exe
Filesize
358KB

MD5
405a484a6f2777f0e4fc429ca05353a7

SHA1
895ae31fab9c5042ddc3f5912c55b81530a20163

SHA256
aba9f9d6904d1474f7a0693e80d182eff9cb8a1c185f0090876cf8eb83914cbb

SHA512
da5771598dcfa6b8fd82a34f8a1ae581b0bd7aa1a51bba978a9ceefdce8639462f182adf94eec70314b25dd6f0c6c7ba7b08bcde479ab8bb7ce4447e00e8a5c8

Download Submit
\Users\Admin\AppData\Local\Temp\aaa.exe
Filesize
171KB

MD5
01f2b5f6403530af79e6f321f4879da0

SHA1
f09790bdab30fd08c312d3b0d4f8ec309a1431bc

SHA256
dc2d40f77af7bd9f6a4d86baee6d1fb3332dc9f8953cfd73f39c914b4990e4e5

SHA512
07b1135e4a116b80d89aa69890c00febbb874cf22456366202a19517e359e3a0e69110fd3ea2246469420de03cbf8aaee08caa6a307283b08f7400c2fdb5fc76

Download Submit
memory/1360-54-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/1360-55-0x0000000000410000-0x000000000043A000-memory.dmp

Filesize
168KB

Download
memory/1360-53-0x0000000000B70000-0x0000000000BA4000-memory.dmp

Filesize
208KB

Download
memory/1952-36-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1952-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1952-49-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1952-42-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1952-38-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1952-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1952-44-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1952-46-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2324-9-0x0000000000660000-0x0000000000672000-memory.dmp

Filesize
72KB

Download
memory/2324-0-0x000000007494E000-0x000000007494F000-memory.dmp

Filesize
4KB

Download
memory/2324-22-0x0000000074940000-0x000000007502E000-memory.dmp

Filesize
6.9MB

Download
memory/2324-4-0x0000000009E70000-0x0000000009F2A000-memory.dmp

Filesize
744KB

Download
memory/2324-3-0x0000000074940000-0x000000007502E000-memory.dmp

Filesize
6.9MB

Download
memory/2324-2-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2324-1-0x00000000000D0000-0x0000000000194000-memory.dmp

Filesize
784KB

Download
memory/2508-57-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2508-59-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2508-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2508-70-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2508-68-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2508-67-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2508-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2508-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2660-13-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2660-15-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2660-16-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2660-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2660-19-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2660-21-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2660-12-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2660-10-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2672-33-0x00000000003F0000-0x0000000000402000-memory.dmp

Filesize
72KB

Download
memory/2672-28-0x0000000000590000-0x00000000005EA000-memory.dmp

Filesize
360KB

Download
memory/2672-26-0x0000000000860000-0x00000000008C2000-memory.dmp

Filesize
392KB

Download
memory/2672-27-0x00000000001F0000-0x00000000001F6000-memory.dmp

Filesize
24KB

Download