azorult | 29cf2aec62c3504b1914484feff17ae470b51229b1df06f1a30334a08b6db12a

General

Target

7fb10b8ea68c1e0064730018fca3cb39.exe
Size

992KB
MD5

7fb10b8ea68c1e0064730018fca3cb39
SHA1

41c371b7053bcf1b7867aeada51e716650afa19a
SHA256

29cf2aec62c3504b1914484feff17ae470b51229b1df06f1a30334a08b6db12a
SHA512

ffe7dd92b0e97fe67bac000ff14bb299d5a0ef353ce965389d52715b9048ec61f9855c6ef8f16dd423f60d490cc2321d3c35e4a6277f2319ec0c482e288bc3aa
SSDEEP

24576:/E0lHcgqgh7/0tgIugNw6GQlGDI/NKs/Y:/Ew8gXYzVtGQVNn/Y

Score

10^/10

azorult oski raccoon fe25b858c52ebb889260990dc343e5dbcf4a96e4 infostealer spyware stealer trojan

Malware Config

Extracted

Family

oski

C2

danielmax.ac.ug

Extracted

Family

raccoon

Version

1.7.3

Botnet

fe25b858c52ebb889260990dc343e5dbcf4a96e4

Attributes

url4cnc
https://telete.in/brikitiki

rc4.plain

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 6 IoCs

resource	yara_rule
behavioral2/memory/2568-39-0x0000000000400000-0x000000000049A000-memory.dmp	family_raccoon_v1
behavioral2/memory/2568-43-0x0000000000400000-0x000000000049A000-memory.dmp	family_raccoon_v1
behavioral2/memory/2568-35-0x0000000000400000-0x000000000049A000-memory.dmp	family_raccoon_v1
behavioral2/memory/2568-34-0x0000000000400000-0x000000000049A000-memory.dmp	family_raccoon_v1
behavioral2/memory/2568-60-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/2568-61-0x0000000000400000-0x000000000049A000-memory.dmp	family_raccoon_v1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	7fb10b8ea68c1e0064730018fca3cb39.exe

Executes dropped EXE 4 IoCs

pid	Process
1456	GFDyrtucbvfdg.exe
3708	DSFnbyhgfrtydfg.exe
3312	DSFnbyhgfrtydfg.exe
3040	GFDyrtucbvfdg.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3708 set thread context of 3312	3708	DSFnbyhgfrtydfg.exe	88
PID 960 set thread context of 2568	960	7fb10b8ea68c1e0064730018fca3cb39.exe	87
PID 1456 set thread context of 3040	1456	GFDyrtucbvfdg.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1916	3312	WerFault.exe	88

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
3708	DSFnbyhgfrtydfg.exe
960	7fb10b8ea68c1e0064730018fca3cb39.exe
1456	GFDyrtucbvfdg.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
960	7fb10b8ea68c1e0064730018fca3cb39.exe
1456	GFDyrtucbvfdg.exe
3708	DSFnbyhgfrtydfg.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 1456	960	7fb10b8ea68c1e0064730018fca3cb39.exe	85
PID 960 wrote to memory of 1456	960	7fb10b8ea68c1e0064730018fca3cb39.exe	85
PID 960 wrote to memory of 1456	960	7fb10b8ea68c1e0064730018fca3cb39.exe	85
PID 960 wrote to memory of 3708	960	7fb10b8ea68c1e0064730018fca3cb39.exe	86
PID 960 wrote to memory of 3708	960	7fb10b8ea68c1e0064730018fca3cb39.exe	86
PID 960 wrote to memory of 3708	960	7fb10b8ea68c1e0064730018fca3cb39.exe	86
PID 3708 wrote to memory of 3312	3708	DSFnbyhgfrtydfg.exe	88
PID 3708 wrote to memory of 3312	3708	DSFnbyhgfrtydfg.exe	88
PID 3708 wrote to memory of 3312	3708	DSFnbyhgfrtydfg.exe	88
PID 960 wrote to memory of 2568	960	7fb10b8ea68c1e0064730018fca3cb39.exe	87
PID 960 wrote to memory of 2568	960	7fb10b8ea68c1e0064730018fca3cb39.exe	87
PID 960 wrote to memory of 2568	960	7fb10b8ea68c1e0064730018fca3cb39.exe	87
PID 3708 wrote to memory of 3312	3708	DSFnbyhgfrtydfg.exe	88
PID 960 wrote to memory of 2568	960	7fb10b8ea68c1e0064730018fca3cb39.exe	87
PID 1456 wrote to memory of 3040	1456	GFDyrtucbvfdg.exe	89
PID 1456 wrote to memory of 3040	1456	GFDyrtucbvfdg.exe	89
PID 1456 wrote to memory of 3040	1456	GFDyrtucbvfdg.exe	89
PID 1456 wrote to memory of 3040	1456	GFDyrtucbvfdg.exe	89

C:\Users\Admin\AppData\Local\Temp\7fb10b8ea68c1e0064730018fca3cb39.exe
"C:\Users\Admin\AppData\Local\Temp\7fb10b8ea68c1e0064730018fca3cb39.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:960
- C:\ProgramData\GFDyrtucbvfdg.exe
  "C:\ProgramData\GFDyrtucbvfdg.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\ProgramData\GFDyrtucbvfdg.exe
    "C:\ProgramData\GFDyrtucbvfdg.exe"
    3⤵
    - Executes dropped EXE
    PID:3040
- C:\Users\Admin\AppData\Roaming\DSFnbyhgfrtydfg.exe
  "C:\Users\Admin\AppData\Roaming\DSFnbyhgfrtydfg.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Users\Admin\AppData\Roaming\DSFnbyhgfrtydfg.exe
    "C:\Users\Admin\AppData\Roaming\DSFnbyhgfrtydfg.exe"
    3⤵
    - Executes dropped EXE
    PID:3312
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 1300
      4⤵
      Program crash
      PID:1916
- C:\Users\Admin\AppData\Local\Temp\7fb10b8ea68c1e0064730018fca3cb39.exe
  "C:\Users\Admin\AppData\Local\Temp\7fb10b8ea68c1e0064730018fca3cb39.exe"
  2⤵
  PID:2568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 3312 -ip 3312
1⤵
PID:4080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\GFDyrtucbvfdg.exe

Filesize
204KB

MD5
701f6f95d5e205b53b3a74403d46981a

SHA1
3e614af86675b0de761adb5d2fa271bfb3142b95

SHA256
36b216e3219f82031317e03235333638e22d5f93c184e403e2383e322be1e459

SHA512
a7f051d91b24c3a42d81507577f8c9c576f6fd68287a56606f1c0dc7c06c7054d325974b3b176ac019815cce5dbb42ff9104e4d1c7f51fee5f9ee9a420c04d15

Download Submit
C:\Users\Admin\AppData\Roaming\DSFnbyhgfrtydfg.exe

Filesize
252KB

MD5
93fffc6736b1dd95a4f4e88734e9d540

SHA1
509a9acffd9b9123fff2a3df9a860b829210f80a

SHA256
80b57df21ba993430e49e63e47f1afd84ac2f64fe50bb0b19413b2f964c42dd0

SHA512
d56d6e46792df1b06449265973e589559ff630ea2bcbcae54ffd0503188477605a63ca4db38f8e5e29d472368902e959f850226cf3ddaa2c0d6ba6ac3b87faed

Download Submit
memory/960-2-0x00000000776A2000-0x00000000776A3000-memory.dmp

Filesize
4KB

Download
memory/960-3-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/1456-28-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2568-60-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2568-45-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/2568-43-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2568-61-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2568-39-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2568-34-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2568-35-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2568-44-0x00000000776A2000-0x00000000776A3000-memory.dmp

Filesize
4KB

Download
memory/3040-54-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3040-50-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3040-52-0x00000000776A2000-0x00000000776A3000-memory.dmp

Filesize
4KB

Download
memory/3040-47-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3040-53-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3312-38-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3312-46-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/3312-42-0x00000000776A2000-0x00000000776A3000-memory.dmp

Filesize
4KB

Download
memory/3312-37-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3312-33-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3312-58-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3312-59-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3708-32-0x0000000000720000-0x0000000000728000-memory.dmp

Filesize
32KB

Download
memory/3708-31-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads