azorult | 547bf6d6ed5ae181513ed653109514c73e5f50c3ea3a094bcd382fbd3c4b4bb0

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-03-2024 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2a770ca66e4ee54f078afe8a2eb27f7.exe
Size

944KB
MD5

c2a770ca66e4ee54f078afe8a2eb27f7
SHA1

6a7432afeeb9367febf8331fe63ffbd44a284b77
SHA256

547bf6d6ed5ae181513ed653109514c73e5f50c3ea3a094bcd382fbd3c4b4bb0
SHA512

571bd2d0d8267071af48525daa5b9a6aba42a14a51e3a85320135da48c0c995f34dcb2adb8440ce585554a4e6e2a17a84290de02db20f166fe6521894477b487
SSDEEP

24576:0XzSYN91YjU3GJSDaBc8WNzELdGfetUG3ixJUkKEl0Ke0:wOYN91Yjk2ZLsGtUGKJUkKEl0Ke0

Score

10^/10

azorult oski raccoon c81fb6015c832710f869f6911e1aec18747e0184 infostealer spyware stealer trojan

Malware Config

Extracted

Family

raccoon

Botnet

c81fb6015c832710f869f6911e1aec18747e0184

Attributes

url4cnc
https://telete.in/brikitiki

rc4.plain

Extracted

Family

azorult

http://195.245.112.115/index.php

Extracted

Family

oski

hsagoi.ac.ug

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

resource	yara_rule
behavioral1/memory/2528-24-0x0000000000400000-0x0000000000496000-memory.dmp	family_raccoon_v1
behavioral1/memory/2528-36-0x0000000000400000-0x0000000000496000-memory.dmp	family_raccoon_v1
behavioral1/memory/2528-49-0x0000000000400000-0x0000000000492000-memory.dmp	family_raccoon_v1
behavioral1/memory/2528-57-0x0000000000400000-0x0000000000496000-memory.dmp	family_raccoon_v1

Executes dropped EXE 4 IoCs

pid	Process
1456	GFsewerhgccbv.exe
2632	GFytrnvbas.exe
2644	GFsewerhgccbv.exe
2724	GFytrnvbas.exe

Loads dropped DLL 11 IoCs

pid	Process
1284	c2a770ca66e4ee54f078afe8a2eb27f7.exe
1284	c2a770ca66e4ee54f078afe8a2eb27f7.exe
1284	c2a770ca66e4ee54f078afe8a2eb27f7.exe
1284	c2a770ca66e4ee54f078afe8a2eb27f7.exe
1456	GFsewerhgccbv.exe
2632	GFytrnvbas.exe
2812	WerFault.exe
2812	WerFault.exe
2812	WerFault.exe
2812	WerFault.exe
2812	WerFault.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1284 set thread context of 2528	1284	c2a770ca66e4ee54f078afe8a2eb27f7.exe	30
PID 1456 set thread context of 2644	1456	GFsewerhgccbv.exe	31
PID 2632 set thread context of 2724	2632	GFytrnvbas.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2812	2724	WerFault.exe	32

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	c2a770ca66e4ee54f078afe8a2eb27f7.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	c2a770ca66e4ee54f078afe8a2eb27f7.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
1284	c2a770ca66e4ee54f078afe8a2eb27f7.exe
1456	GFsewerhgccbv.exe
2632	GFytrnvbas.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1284	c2a770ca66e4ee54f078afe8a2eb27f7.exe
1456	GFsewerhgccbv.exe
2632	GFytrnvbas.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 1456	1284	c2a770ca66e4ee54f078afe8a2eb27f7.exe	28
PID 1284 wrote to memory of 1456	1284	c2a770ca66e4ee54f078afe8a2eb27f7.exe	28
PID 1284 wrote to memory of 1456	1284	c2a770ca66e4ee54f078afe8a2eb27f7.exe	28
PID 1284 wrote to memory of 1456	1284	c2a770ca66e4ee54f078afe8a2eb27f7.exe	28
PID 1284 wrote to memory of 2632	1284	c2a770ca66e4ee54f078afe8a2eb27f7.exe	29
PID 1284 wrote to memory of 2632	1284	c2a770ca66e4ee54f078afe8a2eb27f7.exe	29
PID 1284 wrote to memory of 2632	1284	c2a770ca66e4ee54f078afe8a2eb27f7.exe	29
PID 1284 wrote to memory of 2632	1284	c2a770ca66e4ee54f078afe8a2eb27f7.exe	29
PID 1284 wrote to memory of 2528	1284	c2a770ca66e4ee54f078afe8a2eb27f7.exe	30
PID 1284 wrote to memory of 2528	1284	c2a770ca66e4ee54f078afe8a2eb27f7.exe	30
PID 1284 wrote to memory of 2528	1284	c2a770ca66e4ee54f078afe8a2eb27f7.exe	30
PID 1284 wrote to memory of 2528	1284	c2a770ca66e4ee54f078afe8a2eb27f7.exe	30
PID 1284 wrote to memory of 2528	1284	c2a770ca66e4ee54f078afe8a2eb27f7.exe	30
PID 1456 wrote to memory of 2644	1456	GFsewerhgccbv.exe	31
PID 1456 wrote to memory of 2644	1456	GFsewerhgccbv.exe	31
PID 1456 wrote to memory of 2644	1456	GFsewerhgccbv.exe	31
PID 1456 wrote to memory of 2644	1456	GFsewerhgccbv.exe	31
PID 1456 wrote to memory of 2644	1456	GFsewerhgccbv.exe	31
PID 2632 wrote to memory of 2724	2632	GFytrnvbas.exe	32
PID 2632 wrote to memory of 2724	2632	GFytrnvbas.exe	32
PID 2632 wrote to memory of 2724	2632	GFytrnvbas.exe	32
PID 2632 wrote to memory of 2724	2632	GFytrnvbas.exe	32
PID 2632 wrote to memory of 2724	2632	GFytrnvbas.exe	32
PID 2724 wrote to memory of 2812	2724	GFytrnvbas.exe	35
PID 2724 wrote to memory of 2812	2724	GFytrnvbas.exe	35
PID 2724 wrote to memory of 2812	2724	GFytrnvbas.exe	35
PID 2724 wrote to memory of 2812	2724	GFytrnvbas.exe	35

C:\Users\Admin\AppData\Local\Temp\c2a770ca66e4ee54f078afe8a2eb27f7.exe
"C:\Users\Admin\AppData\Local\Temp\c2a770ca66e4ee54f078afe8a2eb27f7.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Users\Admin\AppData\Local\Temp\GFsewerhgccbv.exe
  "C:\Users\Admin\AppData\Local\Temp\GFsewerhgccbv.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Users\Admin\AppData\Local\Temp\GFsewerhgccbv.exe
    "C:\Users\Admin\AppData\Local\Temp\GFsewerhgccbv.exe"
    3⤵
    - Executes dropped EXE
    PID:2644
- C:\Users\Admin\AppData\Local\Temp\GFytrnvbas.exe
  "C:\Users\Admin\AppData\Local\Temp\GFytrnvbas.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Users\Admin\AppData\Local\Temp\GFytrnvbas.exe
    "C:\Users\Admin\AppData\Local\Temp\GFytrnvbas.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 768
      4⤵
      Loads dropped DLL
      Program crash
      PID:2812
- C:\Users\Admin\AppData\Local\Temp\c2a770ca66e4ee54f078afe8a2eb27f7.exe
  "C:\Users\Admin\AppData\Local\Temp\c2a770ca66e4ee54f078afe8a2eb27f7.exe"
  2⤵
  - Modifies system certificate store
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GFytrnvbas.exe

Filesize
240KB

MD5
b9924928f4b29aeefeae44164fcb572a

SHA1
a8e5d7154f5692ecb437970fa13b10d5f6459a93

SHA256
8a820fde18a110966a32716f5ebc4ca9a991bce2e08a58620f266d5372575bcd

SHA512
16b2450977d174bf43e8ea344b251469b60d4b5c7bd194637dd6418686766925cf382fdda2db4c57e060ad77b1a4b8d29b3500a07dd2e6ceb6a92b01f54ef5b9

Download Submit
\Users\Admin\AppData\Local\Temp\GFsewerhgccbv.exe

Filesize
192KB

MD5
1f52ea06bdd59969bfa0f74cbe3d36e1

SHA1
4ed0c4495a502830c46715fdef20033f29df51f8

SHA256
e6bd46f02b26c3670dbe7af7baa83411c793f7765994bf40ada869a81a4d340a

SHA512
48c7f339498ee5e07be238cf4ab059639557b27ff98f0d69752047ab83cf512ea13373fd7783e2aa9fd7a6a14ae861baceaa4614500f0647cff07255d892d672

Download Submit
memory/1284-23-0x00000000027D0000-0x00000000027D7000-memory.dmp

Filesize
28KB

Download
memory/1284-2-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2528-42-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2528-24-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2528-57-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2528-36-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2528-49-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/2644-29-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2644-47-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2644-48-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2644-33-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2724-43-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2724-45-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2724-46-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2724-37-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2724-50-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2724-59-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2724-60-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads