Analysis
-
max time kernel
25s -
max time network
73s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
08-01-2024 23:10
General
-
Target
4cb2b6e2c86e81a6b2ddd2aca707e66a.exe
-
Size
696KB
-
MD5
4cb2b6e2c86e81a6b2ddd2aca707e66a
-
SHA1
f13428a8ea50c72c6a24bd552804ab7a11428ec1
-
SHA256
157e30e05a61154cbc5bb5e36dc43b33e500bd552f8a0624d3a02d9f1249665a
-
SHA512
156e0c11011753cf46fd4817888c56294ab001c98fc32613e70104d9fd900be874baa30ac3bf5c09e7140eaf336b06f06e85568c7c6a7de0617f06e270048ce7
-
SSDEEP
12288:PBSewDX45BRwe+paNLHwwowZfFeNXeDoxTAn9D22oDgylgIHbqx8:PBS0B+/aRHwwoXteE9An9yhDcI7qx8
Malware Config
Extracted
azorult
http://195.245.112.115/index.php
Extracted
oski
gordonhk.ac.ug
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Detect ZGRat V1 35 IoCs
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cb2b6e2c86e81a6b2ddd2aca707e66a.exe"C:\Users\Admin\AppData\Local\Temp\4cb2b6e2c86e81a6b2ddd2aca707e66a.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\4cb2b6e2c86e81a6b2ddd2aca707e66a.exeC:\Users\Admin\AppData\Local\Temp\4cb2b6e2c86e81a6b2ddd2aca707e66a.exe2⤵
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Eyyozukgtsxfcpfq.vbs"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Gqgistxtagnubptvmqtbtconsoleapp9.exe"C:\Users\Admin\AppData\Local\Temp\Gqgistxtagnubptvmqtbtconsoleapp9.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\Gqgistxtagnubptvmqtbtconsoleapp9.exeC:\Users\Admin\AppData\Local\Temp\Gqgistxtagnubptvmqtbtconsoleapp9.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 13003⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5064 -ip 50641⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
720KB
-
Filesize
680KB
-
Filesize
472KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
7.7MB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
784KB
-
Filesize
64KB
-
Filesize
120KB
-
Filesize
7.7MB
-
Filesize
416KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
376KB
-
Filesize
480KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
208KB
-
Filesize
208KB