azorult | 3bdaeb542939de272d46fa125a9fbfc4a2bb551c3a49c5fbb68d17c45a11446d

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8dcc97027d77b67586b46d6ba571d2b4.exe
Size 1.5MB
Sample240204-a6ws6adfc2
SHA256 3bdaeb542939de272d46fa125a9fbfc4a2bb551c3a49c5fbb68d17c45a11446d
MD5 8dcc97027d77b67586b46d6ba571d2b4
SHA1 ad22432eda3951e822f5a5ec37e66d503a4703eb
SHA512 233a913966a876ad4d7604a4f9c646fabba8e2c6e5d5a125f2317e6168efa05aa001e7a183b293fc573717b540983777fcf17acfe9bb1c0ff98ced401ceedbbd
SSDEEP 24576:i13JKz0ildRWDDD/I1bH1tORRC+ixrw3ORR1+h5LORR5+X1S:i15KzmD+T1toC+ixrw3o1+h5Lo5+X1S
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

azorult oski raccoon c81fb6015c832710f869f6911e1aec18747e0184 infostealer spyware stealer trojan

Malware Config

Extracted

Family

oski

kullasa.ac.ug

Extracted

Family

azorult

http://195.245.112.115/index.php

Extracted

Family

raccoon

Botnet

c81fb6015c832710f869f6911e1aec18747e0184

Attributes

url4cnc
https://telete.in/brikitiki

rc4.plain

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 5 IoCs

resource	yara_rule
behavioral2/memory/3932-48-0x0000000000400000-0x0000000000497000-memory.dmp	family_raccoon_v1
behavioral2/memory/3932-49-0x0000000000400000-0x0000000000497000-memory.dmp	family_raccoon_v1
behavioral2/memory/3932-50-0x0000000000400000-0x0000000000497000-memory.dmp	family_raccoon_v1
behavioral2/memory/3932-62-0x0000000000400000-0x0000000000492000-memory.dmp	family_raccoon_v1
behavioral2/memory/3932-64-0x0000000000400000-0x0000000000497000-memory.dmp	family_raccoon_v1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	8dcc97027d77b67586b46d6ba571d2b4.exe

Executes dropped EXE 4 IoCs

pid	Process
4604	Vdgfgjkhsdwr.exe
4488	Dropakcx.exe
4300	Dropakcx.exe
4116	Vdgfgjkhsdwr.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4488 set thread context of 4300	4488	Dropakcx.exe	85
PID 4604 set thread context of 4116	4604	Vdgfgjkhsdwr.exe	86
PID 4420 set thread context of 3932	4420	8dcc97027d77b67586b46d6ba571d2b4.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4972	4300	WerFault.exe	85

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
4488	Dropakcx.exe
4604	Vdgfgjkhsdwr.exe
4420	8dcc97027d77b67586b46d6ba571d2b4.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4420	8dcc97027d77b67586b46d6ba571d2b4.exe
4488	Dropakcx.exe
4604	Vdgfgjkhsdwr.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 4604	4420	8dcc97027d77b67586b46d6ba571d2b4.exe	83
PID 4420 wrote to memory of 4604	4420	8dcc97027d77b67586b46d6ba571d2b4.exe	83
PID 4420 wrote to memory of 4604	4420	8dcc97027d77b67586b46d6ba571d2b4.exe	83
PID 4420 wrote to memory of 4488	4420	8dcc97027d77b67586b46d6ba571d2b4.exe	84
PID 4420 wrote to memory of 4488	4420	8dcc97027d77b67586b46d6ba571d2b4.exe	84
PID 4420 wrote to memory of 4488	4420	8dcc97027d77b67586b46d6ba571d2b4.exe	84
PID 4488 wrote to memory of 4300	4488	Dropakcx.exe	85
PID 4488 wrote to memory of 4300	4488	Dropakcx.exe	85
PID 4488 wrote to memory of 4300	4488	Dropakcx.exe	85
PID 4488 wrote to memory of 4300	4488	Dropakcx.exe	85
PID 4604 wrote to memory of 4116	4604	Vdgfgjkhsdwr.exe	86
PID 4604 wrote to memory of 4116	4604	Vdgfgjkhsdwr.exe	86
PID 4604 wrote to memory of 4116	4604	Vdgfgjkhsdwr.exe	86
PID 4604 wrote to memory of 4116	4604	Vdgfgjkhsdwr.exe	86
PID 4420 wrote to memory of 3932	4420	8dcc97027d77b67586b46d6ba571d2b4.exe	87
PID 4420 wrote to memory of 3932	4420	8dcc97027d77b67586b46d6ba571d2b4.exe	87
PID 4420 wrote to memory of 3932	4420	8dcc97027d77b67586b46d6ba571d2b4.exe	87
PID 4420 wrote to memory of 3932	4420	8dcc97027d77b67586b46d6ba571d2b4.exe	87

C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe
"C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4420
- C:\ProgramData\Vdgfgjkhsdwr.exe
  "C:\ProgramData\Vdgfgjkhsdwr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\ProgramData\Vdgfgjkhsdwr.exe
    "C:\ProgramData\Vdgfgjkhsdwr.exe"
    3⤵
    - Executes dropped EXE
    PID:4116
- C:\ProgramData\Dropakcx.exe
  "C:\ProgramData\Dropakcx.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\ProgramData\Dropakcx.exe
    "C:\ProgramData\Dropakcx.exe"
    3⤵
    - Executes dropped EXE
    PID:4300
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 1312
      4⤵
      Program crash
      PID:4972
- C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe
  "C:\Users\Admin\AppData\Local\Temp\8dcc97027d77b67586b46d6ba571d2b4.exe"
  2⤵
  PID:3932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4300 -ip 4300
1⤵
PID:4744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Dropakcx.exe

Path C:\ProgramData\Dropakcx.exe
Size 444KB
SHA256 abf5833a2ffa007792753f5d49fd21f00a2c8d20e623f57d9e3748c41fb1435a
MD5 e21551a13085e0ba0fad3e733d807559
SHA1 87aeaaf58c1d8cf23755697489267f289e7c5780
SHA512 21497f7f742b5c2e61bd5b04e10eb71538d6bafd9c00aa793f9798a7035b9c02ac80bce3baa38d6e97a10239df726246a157b8c7db5ceffc31937187659ac189
SSDEEP 6144:OaAdaFLbVgs5d5IanII+5eQ72xEaz5nccN+XPOggN2W3j0RPbyeTwV2DhhTguTz:idbEw1ayG3+fORR0RDy4C2lh5Tz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vdgfgjkhsdwr.exe

Path C:\ProgramData\Vdgfgjkhsdwr.exe
Size 396KB
SHA256 6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177
MD5 b92b398d4e25a976dc699f2099fa8452
SHA1 900e6fedf9898adbbc5f3dc7185372ffb811c8ad
SHA512 5b854a34d489a94d2b193af192cb0d9f224ef1b7d2d0cd50b119a9cd24693c720482e9ddf910b2e9e0ef44e8ad263aa4a69094b503a01ff9a177d8c2cef5f1ed
SSDEEP 6144:gaAkdaLcirZ+3WuJHukOxEaz5nccN+XPOggN2W3j0sPbyeTwV2DhiLgu0S:oGnLmyG3+fORR0sDy4C2lix0S
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3932-52-0x0000000077232000-0x0000000077233000-memory.dmp

Download

memory/3932-50-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3932-62-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/3932-49-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3932-64-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3932-53-0x0000000000500000-0x0000000000501000-memory.dmp

Download

memory/3932-48-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4116-54-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4116-35-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4116-45-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4116-56-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4116-41-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4116-46-0x0000000077232000-0x0000000077233000-memory.dmp

Download

memory/4116-47-0x0000000002040000-0x0000000002041000-memory.dmp

Download

memory/4300-39-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4300-42-0x0000000077232000-0x0000000077233000-memory.dmp

Download

memory/4300-43-0x0000000002050000-0x0000000002051000-memory.dmp

Download

memory/4300-36-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4300-33-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4300-60-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4300-61-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4300-59-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/4420-2-0x0000000077232000-0x0000000077233000-memory.dmp

Download

memory/4420-3-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

Download

memory/4488-32-0x0000000002840000-0x0000000002848000-memory.dmp

Download

memory/4488-30-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

Download

memory/4604-31-0x00000000009B0000-0x00000000009B1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads