azorult | 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
18-05-2024 04:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
Size

749KB
MD5

531c89746f1bb6333331ad28cee32f13
SHA1

4eb7657831ef51aa2e11b40be9f1ed8933e04f28
SHA256

8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48
SHA512

f687f7fb4fdce0df9c19e34f65bc89da2a32126882aa584b138aede3e2d4a6dbb6814d47b17a29e469550c3c3aa6d5fc612f78fbe2ad47b1bb3f50b330d4358a
SSDEEP

12288:E10aMyM86BqwLdltr3gHE1PZlsz/XYzaXe1pW3VONQIeJe0Dtlqse/P3rqQn:E10aMt86B5btr3g1zQ91pWFABovf6

Score

10^/10

azorult oski raccoon 236c7f8a01d741b888dc6b6209805e66d41e62ba infostealer spyware stealer trojan

Malware Config

Extracted

Family

raccoon

Botnet

236c7f8a01d741b888dc6b6209805e66d41e62ba

Attributes

url4cnc
https://telete.in/brikitiki

rc4.plain

Extracted

Family

oski

nadia.ac.ug

Extracted

Family

azorult

http://195.245.112.115/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2008-11-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon_v1
behavioral2/memory/2008-14-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon_v1
behavioral2/memory/2008-16-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon_v1
behavioral2/memory/2008-10-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon_v1
behavioral2/memory/2008-43-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon_v1

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exeWScript.exeooo.exeWScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	ooo.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 4 IoCs

Processes:

ooo.exeooo.exeaaa.exeaaa.exe

pid process

3456 ooo.exe
2096 ooo.exe
2828 aaa.exe
2452 aaa.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
3456	ooo.exe
2096	ooo.exe
2828	aaa.exe
2452	aaa.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exeooo.exeaaa.exe

description	pid	process	target process
PID 224 set thread context of 2008	224	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
PID 3456 set thread context of 2096	3456	ooo.exe	ooo.exe
PID 2828 set thread context of 2452	2828	aaa.exe	aaa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

468 2096 WerFault.exe ooo.exe

pid	pid_target	process	target process
468	2096	WerFault.exe	ooo.exe

Modifies registry class 2 IoCs

Processes:

531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exeooo.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings	ooo.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exeooo.exeaaa.exe

pid process

224 531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
224 531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
3456 ooo.exe
3456 ooo.exe
2828 aaa.exe
2828 aaa.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exeooo.exeaaa.exe

description pid process

Token: SeDebugPrivilege 224 531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
Token: SeDebugPrivilege 3456 ooo.exe
Token: SeDebugPrivilege 2828 aaa.exe

pid	process
224	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
224	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
3456	ooo.exe
3456	ooo.exe
2828	aaa.exe
2828	aaa.exe

description	pid	process
Token: SeDebugPrivilege	224	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
Token: SeDebugPrivilege	3456	ooo.exe
Token: SeDebugPrivilege	2828	aaa.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exeWScript.exeooo.exeWScript.exeaaa.exe

description	pid	process	target process
PID 224 wrote to memory of 2204	224	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	WScript.exe
PID 224 wrote to memory of 2204	224	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	WScript.exe
PID 224 wrote to memory of 2204	224	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	WScript.exe
PID 224 wrote to memory of 2008	224	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
PID 224 wrote to memory of 2008	224	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
PID 224 wrote to memory of 2008	224	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
PID 224 wrote to memory of 2008	224	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
PID 224 wrote to memory of 2008	224	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
PID 224 wrote to memory of 2008	224	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
PID 224 wrote to memory of 2008	224	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
PID 224 wrote to memory of 2008	224	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
PID 224 wrote to memory of 2008	224	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe	531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
PID 2204 wrote to memory of 3456	2204	WScript.exe	ooo.exe
PID 2204 wrote to memory of 3456	2204	WScript.exe	ooo.exe
PID 2204 wrote to memory of 3456	2204	WScript.exe	ooo.exe
PID 3456 wrote to memory of 3324	3456	ooo.exe	WScript.exe
PID 3456 wrote to memory of 3324	3456	ooo.exe	WScript.exe
PID 3456 wrote to memory of 3324	3456	ooo.exe	WScript.exe
PID 3456 wrote to memory of 2096	3456	ooo.exe	ooo.exe
PID 3456 wrote to memory of 2096	3456	ooo.exe	ooo.exe
PID 3456 wrote to memory of 2096	3456	ooo.exe	ooo.exe
PID 3456 wrote to memory of 2096	3456	ooo.exe	ooo.exe
PID 3456 wrote to memory of 2096	3456	ooo.exe	ooo.exe
PID 3456 wrote to memory of 2096	3456	ooo.exe	ooo.exe
PID 3456 wrote to memory of 2096	3456	ooo.exe	ooo.exe
PID 3456 wrote to memory of 2096	3456	ooo.exe	ooo.exe
PID 3456 wrote to memory of 2096	3456	ooo.exe	ooo.exe
PID 3324 wrote to memory of 2828	3324	WScript.exe	aaa.exe
PID 3324 wrote to memory of 2828	3324	WScript.exe	aaa.exe
PID 3324 wrote to memory of 2828	3324	WScript.exe	aaa.exe
PID 2828 wrote to memory of 2452	2828	aaa.exe	aaa.exe
PID 2828 wrote to memory of 2452	2828	aaa.exe	aaa.exe
PID 2828 wrote to memory of 2452	2828	aaa.exe	aaa.exe
PID 2828 wrote to memory of 2452	2828	aaa.exe	aaa.exe
PID 2828 wrote to memory of 2452	2828	aaa.exe	aaa.exe
PID 2828 wrote to memory of 2452	2828	aaa.exe	aaa.exe
PID 2828 wrote to memory of 2452	2828	aaa.exe	aaa.exe
PID 2828 wrote to memory of 2452	2828	aaa.exe	aaa.exe
PID 2828 wrote to memory of 2452	2828	aaa.exe	aaa.exe

C:\Users\Admin\AppData\Local\Temp\531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:224

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Jwoasxr.vbs"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2204

C:\Users\Admin\AppData\Local\Temp\ooo.exe
"C:\Users\Admin\AppData\Local\Temp\ooo.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Gsgxeo.vbs"
4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3324

C:\Users\Admin\AppData\Local\Temp\aaa.exe
"C:\Users\Admin\AppData\Local\Temp\aaa.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828

C:\Users\Admin\AppData\Local\Temp\aaa.exe
"C:\Users\Admin\AppData\Local\Temp\aaa.exe"
6⤵
- Executes dropped EXE
PID:2452

C:\Users\Admin\AppData\Local\Temp\ooo.exe
"C:\Users\Admin\AppData\Local\Temp\ooo.exe"
4⤵
- Executes dropped EXE
PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 1300
5⤵
- Program crash
PID:468

C:\Users\Admin\AppData\Local\Temp\531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\531c89746f1bb6333331ad28cee32f13_JaffaCakes118.exe"
2⤵
PID:2008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2096 -ip 2096
1⤵
PID:4988

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Gsgxeo.vbs
Filesize
91B

MD5
9e77c5f012c8e5ac0f5706f2a906ab6e

SHA1
900598d4cc26f03b37794e4b1f9de7e49cd94ee5

SHA256
d9f14c1c8a8aebed3afdfe07c1243d1b2b1ca4772ef66b902586691327944e38

SHA512
5ee472ea553af3c598f87db7ed1c8ebacd03b4b00c442ca50cb9f6e87488be5eb1e85aec0ea55cbe6c0234b21eddeb8a358bfc66e70be6d22603793ea99ee839

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jwoasxr.vbs
Filesize
91B

MD5
c0c64a797ebd363385bb9670d99054fe

SHA1
055d06d6d514bb5742f72829e5e1748282715094

SHA256
569e18bc2c6d7618e9c7e34e8b6ef116d543ec35b23414d2c2e5a4c84d471409

SHA512
39d4785622cdf99161792aa1cee81b42e4079a9d393906a6796854461a77428c016f624e031c1f3a4cf9d2a347bfcd9b70f709bb32a4d0ddb15027dacb084235

Download Submit
C:\Users\Admin\AppData\Local\Temp\aaa.exe
Filesize
171KB

MD5
01f2b5f6403530af79e6f321f4879da0

SHA1
f09790bdab30fd08c312d3b0d4f8ec309a1431bc

SHA256
dc2d40f77af7bd9f6a4d86baee6d1fb3332dc9f8953cfd73f39c914b4990e4e5

SHA512
07b1135e4a116b80d89aa69890c00febbb874cf22456366202a19517e359e3a0e69110fd3ea2246469420de03cbf8aaee08caa6a307283b08f7400c2fdb5fc76

Download Submit
C:\Users\Admin\AppData\Local\Temp\ooo.exe
Filesize
358KB

MD5
405a484a6f2777f0e4fc429ca05353a7

SHA1
895ae31fab9c5042ddc3f5912c55b81530a20163

SHA256
aba9f9d6904d1474f7a0693e80d182eff9cb8a1c185f0090876cf8eb83914cbb

SHA512
da5771598dcfa6b8fd82a34f8a1ae581b0bd7aa1a51bba978a9ceefdce8639462f182adf94eec70314b25dd6f0c6c7ba7b08bcde479ab8bb7ce4447e00e8a5c8

Download Submit
memory/224-0-0x0000000074FFE000-0x0000000074FFF000-memory.dmp

Filesize
4KB

Download
memory/224-9-0x0000000005550000-0x0000000005562000-memory.dmp

Filesize
72KB

Download
memory/224-1-0x0000000000A80000-0x0000000000B44000-memory.dmp

Filesize
784KB

Download
memory/224-3-0x0000000074FF0000-0x00000000757A0000-memory.dmp

Filesize
7.7MB

Download
memory/224-2-0x0000000002FA0000-0x0000000002FA6000-memory.dmp

Filesize
24KB

Download
memory/224-4-0x0000000005610000-0x00000000056CA000-memory.dmp

Filesize
744KB

Download
memory/224-15-0x0000000074FF0000-0x00000000757A0000-memory.dmp

Filesize
7.7MB

Download
memory/2008-16-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2008-10-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2008-43-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2008-14-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2008-11-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2096-26-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2096-29-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2452-42-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2452-39-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2828-34-0x00000000024C0000-0x00000000024C6000-memory.dmp

Filesize
24KB

Download
memory/2828-33-0x0000000000280000-0x00000000002B4000-memory.dmp

Filesize
208KB

Download
memory/2828-37-0x0000000004AB0000-0x0000000004ADA000-memory.dmp

Filesize
168KB

Download
memory/2828-38-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/3456-21-0x0000000004A60000-0x0000000004ABA000-memory.dmp

Filesize
360KB

Download
memory/3456-20-0x0000000004A00000-0x0000000004A06000-memory.dmp

Filesize
24KB

Download
memory/3456-19-0x00000000000B0000-0x0000000000112000-memory.dmp

Filesize
392KB

Download