Analysis
-
max time kernel
151s -
max time network
177s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 06:42
Static task
static1
Behavioral task
behavioral1
Sample
79abefa5e6692a3096c000815a138d47c43d361b93ff73c2b13a1c8b77321543.ps1
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
79abefa5e6692a3096c000815a138d47c43d361b93ff73c2b13a1c8b77321543.ps1
Resource
win10v2004-20220414-en
General
-
Target
79abefa5e6692a3096c000815a138d47c43d361b93ff73c2b13a1c8b77321543.ps1
-
Size
1.9MB
-
MD5
1fa8859a60ac751d2f902ba0ba4f7f8d
-
SHA1
71ecc132df74adf48989f6074d505120f3af7b60
-
SHA256
79abefa5e6692a3096c000815a138d47c43d361b93ff73c2b13a1c8b77321543
-
SHA512
3452de68d6022daa980f9f82f918107e6d7c28d8d8cf5bb96b66917485d9e6d702fe44f91bd2fa8fc09097201cf927bb2ab71482759bca59b2660fff7ce1e598
Malware Config
Extracted
azorult
http://195.245.112.115/index.php
Extracted
oski
tomasisa.ug
Extracted
raccoon
089d42bf776aba2e6326c9c557e433da6c3501f4
-
url4cnc
https://telete.in/jrikitiki
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Raccoon Stealer Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/688-95-0x0000000000400000-0x0000000000493000-memory.dmp family_raccoon -
Executes dropped EXE 6 IoCs
Processes:
xjk.exeJvdacbs.exeJvdacbs.exePkdfshbas.exePkdfshbas.exexjk.exepid process 1704 xjk.exe 1304 Jvdacbs.exe 364 Jvdacbs.exe 760 Pkdfshbas.exe 1768 Pkdfshbas.exe 688 xjk.exe -
Loads dropped DLL 11 IoCs
Processes:
xjk.exeJvdacbs.exePkdfshbas.exeWerFault.exepid process 1704 xjk.exe 1704 xjk.exe 1304 Jvdacbs.exe 1704 xjk.exe 1704 xjk.exe 760 Pkdfshbas.exe 1240 WerFault.exe 1240 WerFault.exe 1240 WerFault.exe 1240 WerFault.exe 1240 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
Jvdacbs.exePkdfshbas.exexjk.exedescription pid process target process PID 1304 set thread context of 364 1304 Jvdacbs.exe Jvdacbs.exe PID 760 set thread context of 1768 760 Pkdfshbas.exe Pkdfshbas.exe PID 1704 set thread context of 688 1704 xjk.exe xjk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1240 1768 WerFault.exe Pkdfshbas.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1888 powershell.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
Jvdacbs.exePkdfshbas.exexjk.exepid process 1304 Jvdacbs.exe 760 Pkdfshbas.exe 1704 xjk.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1888 powershell.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
xjk.exeJvdacbs.exePkdfshbas.exepid process 1704 xjk.exe 1304 Jvdacbs.exe 760 Pkdfshbas.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
powershell.exexjk.exeJvdacbs.exePkdfshbas.exePkdfshbas.exedescription pid process target process PID 1888 wrote to memory of 1704 1888 powershell.exe xjk.exe PID 1888 wrote to memory of 1704 1888 powershell.exe xjk.exe PID 1888 wrote to memory of 1704 1888 powershell.exe xjk.exe PID 1888 wrote to memory of 1704 1888 powershell.exe xjk.exe PID 1704 wrote to memory of 1304 1704 xjk.exe Jvdacbs.exe PID 1704 wrote to memory of 1304 1704 xjk.exe Jvdacbs.exe PID 1704 wrote to memory of 1304 1704 xjk.exe Jvdacbs.exe PID 1704 wrote to memory of 1304 1704 xjk.exe Jvdacbs.exe PID 1304 wrote to memory of 364 1304 Jvdacbs.exe Jvdacbs.exe PID 1304 wrote to memory of 364 1304 Jvdacbs.exe Jvdacbs.exe PID 1304 wrote to memory of 364 1304 Jvdacbs.exe Jvdacbs.exe PID 1304 wrote to memory of 364 1304 Jvdacbs.exe Jvdacbs.exe PID 1304 wrote to memory of 364 1304 Jvdacbs.exe Jvdacbs.exe PID 1704 wrote to memory of 760 1704 xjk.exe Pkdfshbas.exe PID 1704 wrote to memory of 760 1704 xjk.exe Pkdfshbas.exe PID 1704 wrote to memory of 760 1704 xjk.exe Pkdfshbas.exe PID 1704 wrote to memory of 760 1704 xjk.exe Pkdfshbas.exe PID 760 wrote to memory of 1768 760 Pkdfshbas.exe Pkdfshbas.exe PID 760 wrote to memory of 1768 760 Pkdfshbas.exe Pkdfshbas.exe PID 760 wrote to memory of 1768 760 Pkdfshbas.exe Pkdfshbas.exe PID 760 wrote to memory of 1768 760 Pkdfshbas.exe Pkdfshbas.exe PID 760 wrote to memory of 1768 760 Pkdfshbas.exe Pkdfshbas.exe PID 1704 wrote to memory of 688 1704 xjk.exe xjk.exe PID 1704 wrote to memory of 688 1704 xjk.exe xjk.exe PID 1704 wrote to memory of 688 1704 xjk.exe xjk.exe PID 1704 wrote to memory of 688 1704 xjk.exe xjk.exe PID 1704 wrote to memory of 688 1704 xjk.exe xjk.exe PID 1768 wrote to memory of 1240 1768 Pkdfshbas.exe WerFault.exe PID 1768 wrote to memory of 1240 1768 Pkdfshbas.exe WerFault.exe PID 1768 wrote to memory of 1240 1768 Pkdfshbas.exe WerFault.exe PID 1768 wrote to memory of 1240 1768 Pkdfshbas.exe WerFault.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\79abefa5e6692a3096c000815a138d47c43d361b93ff73c2b13a1c8b77321543.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\xjk.exe"C:\Users\Public\xjk.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Jvdacbs.exe"C:\Users\Admin\AppData\Local\Temp\Jvdacbs.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Jvdacbs.exe"C:\Users\Admin\AppData\Local\Temp\Jvdacbs.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Pkdfshbas.exe"C:\Users\Admin\AppData\Local\Temp\Pkdfshbas.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Pkdfshbas.exe"C:\Users\Admin\AppData\Local\Temp\Pkdfshbas.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 2645⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Public\xjk.exe"C:\Users\Public\xjk.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Jvdacbs.exeFilesize
380KB
MD562835e700428e242e2b3b9a4862504ad
SHA1fc5843c3348ae8507e15e5ccf26de32e8b4f9fee
SHA2563c5a48ddae13424e0a7658c6aa6000c6b7ab4973cbb1ec171f15857dbafa20ef
SHA5124ca0dbd01d4a0d942b9e45ba48fb91b50691353b58fe1eb9e23a2cb7af19dce4c17ef0c001e0472214acb8d524acdcff8b0ad7ec47c1b4156ca78d78f477c4ca
-
C:\Users\Admin\AppData\Local\Temp\Jvdacbs.exeFilesize
380KB
MD562835e700428e242e2b3b9a4862504ad
SHA1fc5843c3348ae8507e15e5ccf26de32e8b4f9fee
SHA2563c5a48ddae13424e0a7658c6aa6000c6b7ab4973cbb1ec171f15857dbafa20ef
SHA5124ca0dbd01d4a0d942b9e45ba48fb91b50691353b58fe1eb9e23a2cb7af19dce4c17ef0c001e0472214acb8d524acdcff8b0ad7ec47c1b4156ca78d78f477c4ca
-
C:\Users\Admin\AppData\Local\Temp\Jvdacbs.exeFilesize
380KB
MD562835e700428e242e2b3b9a4862504ad
SHA1fc5843c3348ae8507e15e5ccf26de32e8b4f9fee
SHA2563c5a48ddae13424e0a7658c6aa6000c6b7ab4973cbb1ec171f15857dbafa20ef
SHA5124ca0dbd01d4a0d942b9e45ba48fb91b50691353b58fe1eb9e23a2cb7af19dce4c17ef0c001e0472214acb8d524acdcff8b0ad7ec47c1b4156ca78d78f477c4ca
-
C:\Users\Admin\AppData\Local\Temp\Pkdfshbas.exeFilesize
428KB
MD5ef0d6ae2da95b84e9571375e120c2af4
SHA17c6fb180c3d041780ee58a14528cdb035bac4d87
SHA25674c58a2deb846ff9f62fbc2a3e43884883251b459d772038a2d1539df7ff9c89
SHA512c2fc4430c175df18abf959e9e4a6d724ef4ad7a3542d3027de5bde7d445131f2f169a43bd3c91d79cfa9654244c3bcd38e6013006e3699ceebc7a45712e1f0c0
-
C:\Users\Admin\AppData\Local\Temp\Pkdfshbas.exeFilesize
428KB
MD5ef0d6ae2da95b84e9571375e120c2af4
SHA17c6fb180c3d041780ee58a14528cdb035bac4d87
SHA25674c58a2deb846ff9f62fbc2a3e43884883251b459d772038a2d1539df7ff9c89
SHA512c2fc4430c175df18abf959e9e4a6d724ef4ad7a3542d3027de5bde7d445131f2f169a43bd3c91d79cfa9654244c3bcd38e6013006e3699ceebc7a45712e1f0c0
-
C:\Users\Admin\AppData\Local\Temp\Pkdfshbas.exeFilesize
428KB
MD5ef0d6ae2da95b84e9571375e120c2af4
SHA17c6fb180c3d041780ee58a14528cdb035bac4d87
SHA25674c58a2deb846ff9f62fbc2a3e43884883251b459d772038a2d1539df7ff9c89
SHA512c2fc4430c175df18abf959e9e4a6d724ef4ad7a3542d3027de5bde7d445131f2f169a43bd3c91d79cfa9654244c3bcd38e6013006e3699ceebc7a45712e1f0c0
-
C:\Users\Public\xjk.exeFilesize
1.4MB
MD57afa1658a6f338122d355720b4864ed2
SHA1d2d6012eba6cea513f1d7b267b562b35b738d46e
SHA25638d0f6d2d2ccd86e63232e4c702202b167be54dd3c8e21d289f21f4d3775a1e5
SHA512a74585ff241320d340a8242d53ed58d853e25b85b3c5ccce0019c8fdcbc3e8df1b01eadd73ccf820bf193852b527702d4f2c95ddcbb0b6e1456d375e04839c2d
-
C:\Users\Public\xjk.exeFilesize
1.4MB
MD57afa1658a6f338122d355720b4864ed2
SHA1d2d6012eba6cea513f1d7b267b562b35b738d46e
SHA25638d0f6d2d2ccd86e63232e4c702202b167be54dd3c8e21d289f21f4d3775a1e5
SHA512a74585ff241320d340a8242d53ed58d853e25b85b3c5ccce0019c8fdcbc3e8df1b01eadd73ccf820bf193852b527702d4f2c95ddcbb0b6e1456d375e04839c2d
-
C:\Users\Public\xjk.exeFilesize
1.4MB
MD57afa1658a6f338122d355720b4864ed2
SHA1d2d6012eba6cea513f1d7b267b562b35b738d46e
SHA25638d0f6d2d2ccd86e63232e4c702202b167be54dd3c8e21d289f21f4d3775a1e5
SHA512a74585ff241320d340a8242d53ed58d853e25b85b3c5ccce0019c8fdcbc3e8df1b01eadd73ccf820bf193852b527702d4f2c95ddcbb0b6e1456d375e04839c2d
-
\Users\Admin\AppData\Local\Temp\Jvdacbs.exeFilesize
380KB
MD562835e700428e242e2b3b9a4862504ad
SHA1fc5843c3348ae8507e15e5ccf26de32e8b4f9fee
SHA2563c5a48ddae13424e0a7658c6aa6000c6b7ab4973cbb1ec171f15857dbafa20ef
SHA5124ca0dbd01d4a0d942b9e45ba48fb91b50691353b58fe1eb9e23a2cb7af19dce4c17ef0c001e0472214acb8d524acdcff8b0ad7ec47c1b4156ca78d78f477c4ca
-
\Users\Admin\AppData\Local\Temp\Jvdacbs.exeFilesize
380KB
MD562835e700428e242e2b3b9a4862504ad
SHA1fc5843c3348ae8507e15e5ccf26de32e8b4f9fee
SHA2563c5a48ddae13424e0a7658c6aa6000c6b7ab4973cbb1ec171f15857dbafa20ef
SHA5124ca0dbd01d4a0d942b9e45ba48fb91b50691353b58fe1eb9e23a2cb7af19dce4c17ef0c001e0472214acb8d524acdcff8b0ad7ec47c1b4156ca78d78f477c4ca
-
\Users\Admin\AppData\Local\Temp\Jvdacbs.exeFilesize
380KB
MD562835e700428e242e2b3b9a4862504ad
SHA1fc5843c3348ae8507e15e5ccf26de32e8b4f9fee
SHA2563c5a48ddae13424e0a7658c6aa6000c6b7ab4973cbb1ec171f15857dbafa20ef
SHA5124ca0dbd01d4a0d942b9e45ba48fb91b50691353b58fe1eb9e23a2cb7af19dce4c17ef0c001e0472214acb8d524acdcff8b0ad7ec47c1b4156ca78d78f477c4ca
-
\Users\Admin\AppData\Local\Temp\Pkdfshbas.exeFilesize
428KB
MD5ef0d6ae2da95b84e9571375e120c2af4
SHA17c6fb180c3d041780ee58a14528cdb035bac4d87
SHA25674c58a2deb846ff9f62fbc2a3e43884883251b459d772038a2d1539df7ff9c89
SHA512c2fc4430c175df18abf959e9e4a6d724ef4ad7a3542d3027de5bde7d445131f2f169a43bd3c91d79cfa9654244c3bcd38e6013006e3699ceebc7a45712e1f0c0
-
\Users\Admin\AppData\Local\Temp\Pkdfshbas.exeFilesize
428KB
MD5ef0d6ae2da95b84e9571375e120c2af4
SHA17c6fb180c3d041780ee58a14528cdb035bac4d87
SHA25674c58a2deb846ff9f62fbc2a3e43884883251b459d772038a2d1539df7ff9c89
SHA512c2fc4430c175df18abf959e9e4a6d724ef4ad7a3542d3027de5bde7d445131f2f169a43bd3c91d79cfa9654244c3bcd38e6013006e3699ceebc7a45712e1f0c0
-
\Users\Admin\AppData\Local\Temp\Pkdfshbas.exeFilesize
428KB
MD5ef0d6ae2da95b84e9571375e120c2af4
SHA17c6fb180c3d041780ee58a14528cdb035bac4d87
SHA25674c58a2deb846ff9f62fbc2a3e43884883251b459d772038a2d1539df7ff9c89
SHA512c2fc4430c175df18abf959e9e4a6d724ef4ad7a3542d3027de5bde7d445131f2f169a43bd3c91d79cfa9654244c3bcd38e6013006e3699ceebc7a45712e1f0c0
-
\Users\Admin\AppData\Local\Temp\Pkdfshbas.exeFilesize
428KB
MD5ef0d6ae2da95b84e9571375e120c2af4
SHA17c6fb180c3d041780ee58a14528cdb035bac4d87
SHA25674c58a2deb846ff9f62fbc2a3e43884883251b459d772038a2d1539df7ff9c89
SHA512c2fc4430c175df18abf959e9e4a6d724ef4ad7a3542d3027de5bde7d445131f2f169a43bd3c91d79cfa9654244c3bcd38e6013006e3699ceebc7a45712e1f0c0
-
\Users\Admin\AppData\Local\Temp\Pkdfshbas.exeFilesize
428KB
MD5ef0d6ae2da95b84e9571375e120c2af4
SHA17c6fb180c3d041780ee58a14528cdb035bac4d87
SHA25674c58a2deb846ff9f62fbc2a3e43884883251b459d772038a2d1539df7ff9c89
SHA512c2fc4430c175df18abf959e9e4a6d724ef4ad7a3542d3027de5bde7d445131f2f169a43bd3c91d79cfa9654244c3bcd38e6013006e3699ceebc7a45712e1f0c0
-
\Users\Admin\AppData\Local\Temp\Pkdfshbas.exeFilesize
428KB
MD5ef0d6ae2da95b84e9571375e120c2af4
SHA17c6fb180c3d041780ee58a14528cdb035bac4d87
SHA25674c58a2deb846ff9f62fbc2a3e43884883251b459d772038a2d1539df7ff9c89
SHA512c2fc4430c175df18abf959e9e4a6d724ef4ad7a3542d3027de5bde7d445131f2f169a43bd3c91d79cfa9654244c3bcd38e6013006e3699ceebc7a45712e1f0c0
-
\Users\Admin\AppData\Local\Temp\Pkdfshbas.exeFilesize
428KB
MD5ef0d6ae2da95b84e9571375e120c2af4
SHA17c6fb180c3d041780ee58a14528cdb035bac4d87
SHA25674c58a2deb846ff9f62fbc2a3e43884883251b459d772038a2d1539df7ff9c89
SHA512c2fc4430c175df18abf959e9e4a6d724ef4ad7a3542d3027de5bde7d445131f2f169a43bd3c91d79cfa9654244c3bcd38e6013006e3699ceebc7a45712e1f0c0
-
\Users\Admin\AppData\Local\Temp\Pkdfshbas.exeFilesize
428KB
MD5ef0d6ae2da95b84e9571375e120c2af4
SHA17c6fb180c3d041780ee58a14528cdb035bac4d87
SHA25674c58a2deb846ff9f62fbc2a3e43884883251b459d772038a2d1539df7ff9c89
SHA512c2fc4430c175df18abf959e9e4a6d724ef4ad7a3542d3027de5bde7d445131f2f169a43bd3c91d79cfa9654244c3bcd38e6013006e3699ceebc7a45712e1f0c0
-
memory/364-72-0x000000000041A684-mapping.dmp
-
memory/364-75-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/688-92-0x000000000043FA98-mapping.dmp
-
memory/688-95-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/760-78-0x0000000000000000-mapping.dmp
-
memory/1240-96-0x0000000000000000-mapping.dmp
-
memory/1304-65-0x0000000000000000-mapping.dmp
-
memory/1304-74-0x0000000000260000-0x0000000000267000-memory.dmpFilesize
28KB
-
memory/1704-58-0x0000000000000000-mapping.dmp
-
memory/1704-89-0x0000000000800000-0x0000000000807000-memory.dmpFilesize
28KB
-
memory/1704-62-0x0000000076191000-0x0000000076193000-memory.dmpFilesize
8KB
-
memory/1768-90-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1768-86-0x0000000000417A8B-mapping.dmp
-
memory/1888-57-0x000000000254B000-0x000000000256A000-memory.dmpFilesize
124KB
-
memory/1888-54-0x000007FEFBA51000-0x000007FEFBA53000-memory.dmpFilesize
8KB
-
memory/1888-56-0x0000000002544000-0x0000000002547000-memory.dmpFilesize
12KB
-
memory/1888-55-0x000007FEF3400000-0x000007FEF3F5D000-memory.dmpFilesize
11.4MB