azorult | 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48

General

Target

8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe
Size

749KB
MD5

531c89746f1bb6333331ad28cee32f13
SHA1

4eb7657831ef51aa2e11b40be9f1ed8933e04f28
SHA256

8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48
SHA512

f687f7fb4fdce0df9c19e34f65bc89da2a32126882aa584b138aede3e2d4a6dbb6814d47b17a29e469550c3c3aa6d5fc612f78fbe2ad47b1bb3f50b330d4358a

Score

10^/10

azorult oski raccoon 236c7f8a01d741b888dc6b6209805e66d41e62ba infostealer spyware stealer trojan

Malware Config

Extracted

Family

raccoon

Botnet

236c7f8a01d741b888dc6b6209805e66d41e62ba

Attributes

url4cnc
https://telete.in/brikitiki

rc4.plain

Extracted

Family

oski

C2

nadia.ac.ug

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4324-134-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral2/memory/4324-135-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral2/memory/4324-136-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral2/memory/4324-141-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon

Executes dropped EXE 4 IoCs

Processes:

ooo.exeooo.exeaaa.exeaaa.exe

pid process

564 ooo.exe
636 ooo.exe
1556 aaa.exe
1112 aaa.exe

pid	process
564	ooo.exe
636	ooo.exe
1556	aaa.exe
1112	aaa.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exeWScript.exeooo.exeWScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	ooo.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	WScript.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 3 IoCs

Processes:

8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exeooo.exeaaa.exe

description	pid	process	target process
PID 4132 set thread context of 4324	4132	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe
PID 564 set thread context of 636	564	ooo.exe	ooo.exe
PID 1556 set thread context of 1112	1556	aaa.exe	aaa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4276 636 WerFault.exe ooo.exe

pid	pid_target	process	target process
4276	636	WerFault.exe	ooo.exe

Modifies registry class 2 IoCs

Processes:

ooo.exe8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	ooo.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exeooo.exeaaa.exe

pid	process
4132	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe
4132	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe
564	ooo.exe
564	ooo.exe
1556	aaa.exe
1556	aaa.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exeooo.exeaaa.exe

description	pid	process
Token: SeDebugPrivilege	4132	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe
Token: SeDebugPrivilege	564	ooo.exe
Token: SeDebugPrivilege	1556	aaa.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exeWScript.exeooo.exeWScript.exeaaa.exe

description	pid	process	target process
PID 4132 wrote to memory of 4424	4132	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe	WScript.exe
PID 4132 wrote to memory of 4424	4132	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe	WScript.exe
PID 4132 wrote to memory of 4424	4132	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe	WScript.exe
PID 4132 wrote to memory of 4324	4132	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe
PID 4132 wrote to memory of 4324	4132	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe
PID 4132 wrote to memory of 4324	4132	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe
PID 4132 wrote to memory of 4324	4132	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe
PID 4132 wrote to memory of 4324	4132	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe
PID 4132 wrote to memory of 4324	4132	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe
PID 4132 wrote to memory of 4324	4132	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe
PID 4132 wrote to memory of 4324	4132	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe
PID 4132 wrote to memory of 4324	4132	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe	8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe
PID 4424 wrote to memory of 564	4424	WScript.exe	ooo.exe
PID 4424 wrote to memory of 564	4424	WScript.exe	ooo.exe
PID 4424 wrote to memory of 564	4424	WScript.exe	ooo.exe
PID 564 wrote to memory of 4764	564	ooo.exe	WScript.exe
PID 564 wrote to memory of 4764	564	ooo.exe	WScript.exe
PID 564 wrote to memory of 4764	564	ooo.exe	WScript.exe
PID 564 wrote to memory of 636	564	ooo.exe	ooo.exe
PID 564 wrote to memory of 636	564	ooo.exe	ooo.exe
PID 564 wrote to memory of 636	564	ooo.exe	ooo.exe
PID 564 wrote to memory of 636	564	ooo.exe	ooo.exe
PID 564 wrote to memory of 636	564	ooo.exe	ooo.exe
PID 564 wrote to memory of 636	564	ooo.exe	ooo.exe
PID 564 wrote to memory of 636	564	ooo.exe	ooo.exe
PID 564 wrote to memory of 636	564	ooo.exe	ooo.exe
PID 564 wrote to memory of 636	564	ooo.exe	ooo.exe
PID 4764 wrote to memory of 1556	4764	WScript.exe	aaa.exe
PID 4764 wrote to memory of 1556	4764	WScript.exe	aaa.exe
PID 4764 wrote to memory of 1556	4764	WScript.exe	aaa.exe
PID 1556 wrote to memory of 1112	1556	aaa.exe	aaa.exe
PID 1556 wrote to memory of 1112	1556	aaa.exe	aaa.exe
PID 1556 wrote to memory of 1112	1556	aaa.exe	aaa.exe
PID 1556 wrote to memory of 1112	1556	aaa.exe	aaa.exe
PID 1556 wrote to memory of 1112	1556	aaa.exe	aaa.exe
PID 1556 wrote to memory of 1112	1556	aaa.exe	aaa.exe
PID 1556 wrote to memory of 1112	1556	aaa.exe	aaa.exe
PID 1556 wrote to memory of 1112	1556	aaa.exe	aaa.exe
PID 1556 wrote to memory of 1112	1556	aaa.exe	aaa.exe

C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe
"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4132

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Jwoasxr.vbs"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4424

C:\Users\Admin\AppData\Local\Temp\ooo.exe
"C:\Users\Admin\AppData\Local\Temp\ooo.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:564

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Gsgxeo.vbs"
4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4764

C:\Users\Admin\AppData\Local\Temp\aaa.exe
"C:\Users\Admin\AppData\Local\Temp\aaa.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556

C:\Users\Admin\AppData\Local\Temp\aaa.exe
"C:\Users\Admin\AppData\Local\Temp\aaa.exe"
6⤵
- Executes dropped EXE
PID:1112

C:\Users\Admin\AppData\Local\Temp\ooo.exe
"C:\Users\Admin\AppData\Local\Temp\ooo.exe"
4⤵
- Executes dropped EXE
PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 1308
5⤵
- Program crash
PID:4276

C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe
"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"
2⤵
PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 636 -ip 636
1⤵
PID:3988

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Gsgxeo.vbs
Filesize
91B

MD5
9e77c5f012c8e5ac0f5706f2a906ab6e

SHA1
900598d4cc26f03b37794e4b1f9de7e49cd94ee5

SHA256
d9f14c1c8a8aebed3afdfe07c1243d1b2b1ca4772ef66b902586691327944e38

SHA512
5ee472ea553af3c598f87db7ed1c8ebacd03b4b00c442ca50cb9f6e87488be5eb1e85aec0ea55cbe6c0234b21eddeb8a358bfc66e70be6d22603793ea99ee839

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jwoasxr.vbs
Filesize
91B

MD5
c0c64a797ebd363385bb9670d99054fe

SHA1
055d06d6d514bb5742f72829e5e1748282715094

SHA256
569e18bc2c6d7618e9c7e34e8b6ef116d543ec35b23414d2c2e5a4c84d471409

SHA512
39d4785622cdf99161792aa1cee81b42e4079a9d393906a6796854461a77428c016f624e031c1f3a4cf9d2a347bfcd9b70f709bb32a4d0ddb15027dacb084235

Download Submit
C:\Users\Admin\AppData\Local\Temp\aaa.exe
Filesize
171KB

MD5
01f2b5f6403530af79e6f321f4879da0

SHA1
f09790bdab30fd08c312d3b0d4f8ec309a1431bc

SHA256
dc2d40f77af7bd9f6a4d86baee6d1fb3332dc9f8953cfd73f39c914b4990e4e5

SHA512
07b1135e4a116b80d89aa69890c00febbb874cf22456366202a19517e359e3a0e69110fd3ea2246469420de03cbf8aaee08caa6a307283b08f7400c2fdb5fc76

Download Submit
C:\Users\Admin\AppData\Local\Temp\aaa.exe
Filesize
171KB

MD5
01f2b5f6403530af79e6f321f4879da0

SHA1
f09790bdab30fd08c312d3b0d4f8ec309a1431bc

SHA256
dc2d40f77af7bd9f6a4d86baee6d1fb3332dc9f8953cfd73f39c914b4990e4e5

SHA512
07b1135e4a116b80d89aa69890c00febbb874cf22456366202a19517e359e3a0e69110fd3ea2246469420de03cbf8aaee08caa6a307283b08f7400c2fdb5fc76

Download Submit
C:\Users\Admin\AppData\Local\Temp\aaa.exe
Filesize
171KB

MD5
01f2b5f6403530af79e6f321f4879da0

SHA1
f09790bdab30fd08c312d3b0d4f8ec309a1431bc

SHA256
dc2d40f77af7bd9f6a4d86baee6d1fb3332dc9f8953cfd73f39c914b4990e4e5

SHA512
07b1135e4a116b80d89aa69890c00febbb874cf22456366202a19517e359e3a0e69110fd3ea2246469420de03cbf8aaee08caa6a307283b08f7400c2fdb5fc76

Download Submit
C:\Users\Admin\AppData\Local\Temp\ooo.exe
Filesize
358KB

MD5
405a484a6f2777f0e4fc429ca05353a7

SHA1
895ae31fab9c5042ddc3f5912c55b81530a20163

SHA256
aba9f9d6904d1474f7a0693e80d182eff9cb8a1c185f0090876cf8eb83914cbb

SHA512
da5771598dcfa6b8fd82a34f8a1ae581b0bd7aa1a51bba978a9ceefdce8639462f182adf94eec70314b25dd6f0c6c7ba7b08bcde479ab8bb7ce4447e00e8a5c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ooo.exe
Filesize
358KB

MD5
405a484a6f2777f0e4fc429ca05353a7

SHA1
895ae31fab9c5042ddc3f5912c55b81530a20163

SHA256
aba9f9d6904d1474f7a0693e80d182eff9cb8a1c185f0090876cf8eb83914cbb

SHA512
da5771598dcfa6b8fd82a34f8a1ae581b0bd7aa1a51bba978a9ceefdce8639462f182adf94eec70314b25dd6f0c6c7ba7b08bcde479ab8bb7ce4447e00e8a5c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ooo.exe
Filesize
358KB

MD5
405a484a6f2777f0e4fc429ca05353a7

SHA1
895ae31fab9c5042ddc3f5912c55b81530a20163

SHA256
aba9f9d6904d1474f7a0693e80d182eff9cb8a1c185f0090876cf8eb83914cbb

SHA512
da5771598dcfa6b8fd82a34f8a1ae581b0bd7aa1a51bba978a9ceefdce8639462f182adf94eec70314b25dd6f0c6c7ba7b08bcde479ab8bb7ce4447e00e8a5c8

Download Submit
memory/564-140-0x00000000008E0000-0x0000000000942000-memory.dmp

Filesize
392KB

Download
memory/564-138-0x0000000000000000-mapping.dmp

Download
memory/636-144-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/636-143-0x0000000000000000-mapping.dmp

Download
memory/636-147-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/636-148-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/636-153-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1112-159-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1112-158-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1112-155-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1112-154-0x0000000000000000-mapping.dmp

Download
memory/1556-152-0x0000000000D00000-0x0000000000D34000-memory.dmp

Filesize
208KB

Download
memory/1556-150-0x0000000000000000-mapping.dmp

Download
memory/4132-130-0x00000000008C0000-0x0000000000984000-memory.dmp

Filesize
784KB

Download
memory/4324-141-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/4324-132-0x0000000000000000-mapping.dmp

Download
memory/4324-134-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/4324-135-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/4324-136-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/4424-131-0x0000000000000000-mapping.dmp

Download
memory/4764-142-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads