azorult | 3bdaeb542939de272d46fa125a9fbfc4a2bb551c3a49c5fbb68d17c45a11446d

General

Target

8dcc97027d77b67586b46d6ba571d2b4.exe
Size

1.5MB
MD5

8dcc97027d77b67586b46d6ba571d2b4
SHA1

ad22432eda3951e822f5a5ec37e66d503a4703eb
SHA256

3bdaeb542939de272d46fa125a9fbfc4a2bb551c3a49c5fbb68d17c45a11446d
SHA512

233a913966a876ad4d7604a4f9c646fabba8e2c6e5d5a125f2317e6168efa05aa001e7a183b293fc573717b540983777fcf17acfe9bb1c0ff98ced401ceedbbd
SSDEEP

24576:i13JKz0ildRWDDD/I1bH1tORRC+ixrw3ORR1+h5LORR5+X1S:i15KzmD+T1toC+ixrw3o1+h5Lo5+X1S

Score

10^/10

azorult oski raccoon c81fb6015c832710f869f6911e1aec18747e0184 infostealer spyware stealer trojan

Malware Config

Extracted

Family

oski

C2

kullasa.ac.ug

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Extracted

Family

raccoon

Botnet

c81fb6015c832710f869f6911e1aec18747e0184

Attributes

url4cnc
https://telete.in/brikitiki

rc4.plain

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3932-48-0x0000000000400000-0x0000000000497000-memory.dmp	family_raccoon_v1
behavioral2/memory/3932-49-0x0000000000400000-0x0000000000497000-memory.dmp	family_raccoon_v1
behavioral2/memory/3932-50-0x0000000000400000-0x0000000000497000-memory.dmp	family_raccoon_v1
behavioral2/memory/3932-62-0x0000000000400000-0x0000000000492000-memory.dmp	family_raccoon_v1
behavioral2/memory/3932-64-0x0000000000400000-0x0000000000497000-memory.dmp	family_raccoon_v1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8dcc97027d77b67586b46d6ba571d2b4.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	8dcc97027d77b67586b46d6ba571d2b4.exe

Executes dropped EXE 4 IoCs

Processes:

Vdgfgjkhsdwr.exeDropakcx.exeDropakcx.exeVdgfgjkhsdwr.exe

pid process

4604 Vdgfgjkhsdwr.exe
4488 Dropakcx.exe
4300 Dropakcx.exe
4116 Vdgfgjkhsdwr.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4604	Vdgfgjkhsdwr.exe
4488	Dropakcx.exe
4300	Dropakcx.exe
4116	Vdgfgjkhsdwr.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Dropakcx.exeVdgfgjkhsdwr.exe8dcc97027d77b67586b46d6ba571d2b4.exe

description	pid	process	target process
PID 4488 set thread context of 4300	4488	Dropakcx.exe	Dropakcx.exe
PID 4604 set thread context of 4116	4604	Vdgfgjkhsdwr.exe	Vdgfgjkhsdwr.exe
PID 4420 set thread context of 3932	4420	8dcc97027d77b67586b46d6ba571d2b4.exe	8dcc97027d77b67586b46d6ba571d2b4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4972 4300 WerFault.exe Dropakcx.exe
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

Dropakcx.exeVdgfgjkhsdwr.exe8dcc97027d77b67586b46d6ba571d2b4.exe

pid process

4488 Dropakcx.exe
4604 Vdgfgjkhsdwr.exe
4420 8dcc97027d77b67586b46d6ba571d2b4.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

8dcc97027d77b67586b46d6ba571d2b4.exeDropakcx.exeVdgfgjkhsdwr.exe

pid process

4420 8dcc97027d77b67586b46d6ba571d2b4.exe
4488 Dropakcx.exe
4604 Vdgfgjkhsdwr.exe

pid	pid_target	process	target process
4972	4300	WerFault.exe	Dropakcx.exe

pid	process
4488	Dropakcx.exe
4604	Vdgfgjkhsdwr.exe
4420	8dcc97027d77b67586b46d6ba571d2b4.exe

pid	process
4420	8dcc97027d77b67586b46d6ba571d2b4.exe
4488	Dropakcx.exe
4604	Vdgfgjkhsdwr.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

8dcc97027d77b67586b46d6ba571d2b4.exeDropakcx.exeVdgfgjkhsdwr.exe

description	pid	process	target process
PID 4420 wrote to memory of 4604	4420	8dcc97027d77b67586b46d6ba571d2b4.exe	Vdgfgjkhsdwr.exe
PID 4420 wrote to memory of 4604	4420	8dcc97027d77b67586b46d6ba571d2b4.exe	Vdgfgjkhsdwr.exe
PID 4420 wrote to memory of 4604	4420	8dcc97027d77b67586b46d6ba571d2b4.exe	Vdgfgjkhsdwr.exe
PID 4420 wrote to memory of 4488	4420	8dcc97027d77b67586b46d6ba571d2b4.exe	Dropakcx.exe
PID 4420 wrote to memory of 4488	4420	8dcc97027d77b67586b46d6ba571d2b4.exe	Dropakcx.exe
PID 4420 wrote to memory of 4488	4420	8dcc97027d77b67586b46d6ba571d2b4.exe	Dropakcx.exe
PID 4488 wrote to memory of 4300	4488	Dropakcx.exe	Dropakcx.exe
PID 4488 wrote to memory of 4300	4488	Dropakcx.exe	Dropakcx.exe
PID 4488 wrote to memory of 4300	4488	Dropakcx.exe	Dropakcx.exe
PID 4488 wrote to memory of 4300	4488	Dropakcx.exe	Dropakcx.exe
PID 4604 wrote to memory of 4116	4604	Vdgfgjkhsdwr.exe	Vdgfgjkhsdwr.exe
PID 4604 wrote to memory of 4116	4604	Vdgfgjkhsdwr.exe	Vdgfgjkhsdwr.exe
PID 4604 wrote to memory of 4116	4604	Vdgfgjkhsdwr.exe	Vdgfgjkhsdwr.exe
PID 4604 wrote to memory of 4116	4604	Vdgfgjkhsdwr.exe	Vdgfgjkhsdwr.exe
PID 4420 wrote to memory of 3932	4420	8dcc97027d77b67586b46d6ba571d2b4.exe	8dcc97027d77b67586b46d6ba571d2b4.exe
PID 4420 wrote to memory of 3932	4420	8dcc97027d77b67586b46d6ba571d2b4.exe	8dcc97027d77b67586b46d6ba571d2b4.exe
PID 4420 wrote to memory of 3932	4420	8dcc97027d77b67586b46d6ba571d2b4.exe	8dcc97027d77b67586b46d6ba571d2b4.exe
PID 4420 wrote to memory of 3932	4420	8dcc97027d77b67586b46d6ba571d2b4.exe	8dcc97027d77b67586b46d6ba571d2b4.exe

C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe
"C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4420
- C:\ProgramData\Vdgfgjkhsdwr.exe
  "C:\ProgramData\Vdgfgjkhsdwr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\ProgramData\Vdgfgjkhsdwr.exe
    "C:\ProgramData\Vdgfgjkhsdwr.exe"
    3⤵
    - Executes dropped EXE
    PID:4116
- C:\ProgramData\Dropakcx.exe
  "C:\ProgramData\Dropakcx.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\ProgramData\Dropakcx.exe
    "C:\ProgramData\Dropakcx.exe"
    3⤵
    - Executes dropped EXE
    PID:4300
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 1312
      4⤵
      Program crash
      PID:4972
- C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe
  "C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe"
  2⤵
  PID:3932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4300 -ip 4300
1⤵
PID:4744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Dropakcx.exe

Filesize
444KB

MD5
e21551a13085e0ba0fad3e733d807559

SHA1
87aeaaf58c1d8cf23755697489267f289e7c5780

SHA256
abf5833a2ffa007792753f5d49fd21f00a2c8d20e623f57d9e3748c41fb1435a

SHA512
21497f7f742b5c2e61bd5b04e10eb71538d6bafd9c00aa793f9798a7035b9c02ac80bce3baa38d6e97a10239df726246a157b8c7db5ceffc31937187659ac189

Download Submit
C:\ProgramData\Vdgfgjkhsdwr.exe

Filesize
396KB

MD5
b92b398d4e25a976dc699f2099fa8452

SHA1
900e6fedf9898adbbc5f3dc7185372ffb811c8ad

SHA256
6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177

SHA512
5b854a34d489a94d2b193af192cb0d9f224ef1b7d2d0cd50b119a9cd24693c720482e9ddf910b2e9e0ef44e8ad263aa4a69094b503a01ff9a177d8c2cef5f1ed

Download Submit
memory/3932-52-0x0000000077232000-0x0000000077233000-memory.dmp

Filesize
4KB

Download
memory/3932-50-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/3932-62-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/3932-49-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/3932-64-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/3932-53-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/3932-48-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/4116-54-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4116-35-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4116-45-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4116-56-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4116-41-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4116-46-0x0000000077232000-0x0000000077233000-memory.dmp

Filesize
4KB

Download
memory/4116-47-0x0000000002040000-0x0000000002041000-memory.dmp

Filesize
4KB

Download
memory/4300-39-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4300-42-0x0000000077232000-0x0000000077233000-memory.dmp

Filesize
4KB

Download
memory/4300-43-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/4300-36-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4300-33-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4300-60-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4300-61-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4300-59-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/4420-2-0x0000000077232000-0x0000000077233000-memory.dmp

Filesize
4KB

Download
memory/4420-3-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

Filesize
4KB

Download
memory/4488-32-0x0000000002840000-0x0000000002848000-memory.dmp

Filesize
32KB

Download
memory/4488-30-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

Filesize
4KB

Download
memory/4604-31-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads