azorult | 0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a

General

Target

0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
Size

1.1MB
MD5

67fb804e2e006ac7fdb5ec617f43aa35
SHA1

6b82e6290ef6d0141f26acde06fa7e2096fb46b2
SHA256

0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a
SHA512

721ea1beda72977b30cef1a929bb371e9d3808ff01a0cbb7653329f8e9aa227385dd6971409f62d9029e9372ad4e03da96635b407786c42180992c837b583a7d

Score

10^/10

azorult oski raccoon 180d3985eb74eacf2de83c771fbf30a60f670ec0 infostealer spyware stealer trojan

Malware Config

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Extracted

Family

oski

C2

mantis.ug

Extracted

Family

raccoon

Botnet

180d3985eb74eacf2de83c771fbf30a60f670ec0

Attributes

url4cnc
https://telete.in/jrikitiki

rc4.plain

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3680-151-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon

Executes dropped EXE 4 IoCs

Processes:

Pvjkdebv.exePvjadebv.exePvjkdebv.exePvjadebv.exe

pid process

3124 Pvjkdebv.exe
3152 Pvjadebv.exe
2028 Pvjkdebv.exe
4480 Pvjadebv.exe

pid	process
3124	Pvjkdebv.exe
3152	Pvjadebv.exe
2028	Pvjkdebv.exe
4480	Pvjadebv.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

Processes:

0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exePvjkdebv.exePvjadebv.exe

pid	process
3680	0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
3680	0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
2028	Pvjkdebv.exe
2028	Pvjkdebv.exe
4480	Pvjadebv.exe
4480	Pvjadebv.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exePvjkdebv.exePvjadebv.exe

description	pid	process	target process
PID 2836 set thread context of 3680	2836	0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe	0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
PID 3124 set thread context of 2028	3124	Pvjkdebv.exe	Pvjkdebv.exe
PID 3152 set thread context of 4480	3152	Pvjadebv.exe	Pvjadebv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4564 2028 WerFault.exe Pvjkdebv.exe
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exePvjkdebv.exePvjadebv.exe

pid process

2836 0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
3124 Pvjkdebv.exe
3152 Pvjadebv.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exePvjkdebv.exePvjadebv.exe

pid process

2836 0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
3124 Pvjkdebv.exe
3152 Pvjadebv.exe

pid	pid_target	process	target process
4564	2028	WerFault.exe	Pvjkdebv.exe

pid	process
2836	0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
3124	Pvjkdebv.exe
3152	Pvjadebv.exe

pid	process
2836	0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
3124	Pvjkdebv.exe
3152	Pvjadebv.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exePvjkdebv.exePvjadebv.exe

description	pid	process	target process
PID 2836 wrote to memory of 3124	2836	0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe	Pvjkdebv.exe
PID 2836 wrote to memory of 3124	2836	0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe	Pvjkdebv.exe
PID 2836 wrote to memory of 3124	2836	0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe	Pvjkdebv.exe
PID 2836 wrote to memory of 3152	2836	0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe	Pvjadebv.exe
PID 2836 wrote to memory of 3152	2836	0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe	Pvjadebv.exe
PID 2836 wrote to memory of 3152	2836	0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe	Pvjadebv.exe
PID 2836 wrote to memory of 3680	2836	0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe	0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
PID 2836 wrote to memory of 3680	2836	0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe	0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
PID 2836 wrote to memory of 3680	2836	0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe	0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
PID 2836 wrote to memory of 3680	2836	0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe	0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
PID 3124 wrote to memory of 2028	3124	Pvjkdebv.exe	Pvjkdebv.exe
PID 3124 wrote to memory of 2028	3124	Pvjkdebv.exe	Pvjkdebv.exe
PID 3124 wrote to memory of 2028	3124	Pvjkdebv.exe	Pvjkdebv.exe
PID 3124 wrote to memory of 2028	3124	Pvjkdebv.exe	Pvjkdebv.exe
PID 3152 wrote to memory of 4480	3152	Pvjadebv.exe	Pvjadebv.exe
PID 3152 wrote to memory of 4480	3152	Pvjadebv.exe	Pvjadebv.exe
PID 3152 wrote to memory of 4480	3152	Pvjadebv.exe	Pvjadebv.exe
PID 3152 wrote to memory of 4480	3152	Pvjadebv.exe	Pvjadebv.exe

C:\Users\Admin\AppData\Local\Temp\0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
"C:\Users\Admin\AppData\Local\Temp\0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836

C:\Users\Admin\AppData\Local\Temp\Pvjkdebv.exe
"C:\Users\Admin\AppData\Local\Temp\Pvjkdebv.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3124

C:\Users\Admin\AppData\Local\Temp\Pvjkdebv.exe
"C:\Users\Admin\AppData\Local\Temp\Pvjkdebv.exe"
3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 1296
4⤵
- Program crash
PID:4564

C:\Users\Admin\AppData\Local\Temp\Pvjadebv.exe
"C:\Users\Admin\AppData\Local\Temp\Pvjadebv.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3152

C:\Users\Admin\AppData\Local\Temp\Pvjadebv.exe
"C:\Users\Admin\AppData\Local\Temp\Pvjadebv.exe"
3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4480

C:\Users\Admin\AppData\Local\Temp\0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
"C:\Users\Admin\AppData\Local\Temp\0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2028 -ip 2028
1⤵
PID:4276

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Pvjadebv.exe
Filesize
228KB

MD5
b782496c71766cd400caa4ea48dbc939

SHA1
4c154e3c272948621f00d526aeb3804dc8515ace

SHA256
9eb6fe1bd18fde5d7339719df4d2a86bb1aae1ef5940410f9be2dc2fdbbf61e0

SHA512
49645abf1c159f2bc012a8621f6a4b1ce6d87954753014c3ee7625e50d533b80013f90d2bcb0e20c38f6991a7bc7e315133d7a3bb1f37b9a922623e70d55c518

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pvjadebv.exe
Filesize
228KB

MD5
b782496c71766cd400caa4ea48dbc939

SHA1
4c154e3c272948621f00d526aeb3804dc8515ace

SHA256
9eb6fe1bd18fde5d7339719df4d2a86bb1aae1ef5940410f9be2dc2fdbbf61e0

SHA512
49645abf1c159f2bc012a8621f6a4b1ce6d87954753014c3ee7625e50d533b80013f90d2bcb0e20c38f6991a7bc7e315133d7a3bb1f37b9a922623e70d55c518

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pvjadebv.exe
Filesize
228KB

MD5
b782496c71766cd400caa4ea48dbc939

SHA1
4c154e3c272948621f00d526aeb3804dc8515ace

SHA256
9eb6fe1bd18fde5d7339719df4d2a86bb1aae1ef5940410f9be2dc2fdbbf61e0

SHA512
49645abf1c159f2bc012a8621f6a4b1ce6d87954753014c3ee7625e50d533b80013f90d2bcb0e20c38f6991a7bc7e315133d7a3bb1f37b9a922623e70d55c518

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pvjkdebv.exe
Filesize
272KB

MD5
1c57b1ffb059b7cd3a7cd64f8658eef0

SHA1
e89a4d44e48ab1b80cc4386d10b7bde4467bcd4b

SHA256
7f2fb08742f42d241cdb1936fc5f18a7ee05dd53a1500c9d9ebbd30e50e75699

SHA512
ae1f0e59b3f355bdd1046721fe91a8d4bcf732baf097b5b65847b6e1ba731da910c540f84d51aed8d1286c539534c59f2368b8a32e1daa680a3d498e3aad4008

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pvjkdebv.exe
Filesize
272KB

MD5
1c57b1ffb059b7cd3a7cd64f8658eef0

SHA1
e89a4d44e48ab1b80cc4386d10b7bde4467bcd4b

SHA256
7f2fb08742f42d241cdb1936fc5f18a7ee05dd53a1500c9d9ebbd30e50e75699

SHA512
ae1f0e59b3f355bdd1046721fe91a8d4bcf732baf097b5b65847b6e1ba731da910c540f84d51aed8d1286c539534c59f2368b8a32e1daa680a3d498e3aad4008

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pvjkdebv.exe
Filesize
272KB

MD5
1c57b1ffb059b7cd3a7cd64f8658eef0

SHA1
e89a4d44e48ab1b80cc4386d10b7bde4467bcd4b

SHA256
7f2fb08742f42d241cdb1936fc5f18a7ee05dd53a1500c9d9ebbd30e50e75699

SHA512
ae1f0e59b3f355bdd1046721fe91a8d4bcf732baf097b5b65847b6e1ba731da910c540f84d51aed8d1286c539534c59f2368b8a32e1daa680a3d498e3aad4008

Download Submit
memory/2028-149-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2028-142-0x0000000000000000-mapping.dmp

Download
memory/2836-145-0x0000000003600000-0x0000000003607000-memory.dmp

Filesize
28KB

Download
memory/3124-148-0x0000000000630000-0x0000000000637000-memory.dmp

Filesize
28KB

Download
memory/3124-132-0x0000000000000000-mapping.dmp

Download
memory/3152-135-0x0000000000000000-mapping.dmp

Download
memory/3680-140-0x0000000000000000-mapping.dmp

Download
memory/3680-151-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/4480-146-0x0000000000000000-mapping.dmp

Download
memory/4480-150-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads