Analysis
- max time kernel
93s - max time network
115s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
19/04/2024, 04:33
General
- Target f98399c21666ab44ffe10da4e3326546_JaffaCakes118.exe
- Size 353KB
- Sample240419-e6shyshh9y
- SHA256 1ca8a6eb97e3bdc6632c0f4263c759a2a2b0b65c765bdb57437312f509452ce7
Malware Config
Extracted
-
azorult
-
http://37.0.10.99/PL341/index.php
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- Detect ZGRat V1 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f98399c21666ab44ffe10da4e3326546_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f98399c21666ab44ffe10da4e3326546_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compILer.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compILer.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2380-0-0x00000000005E0000-0x000000000063E000-memory.dmp
memory/2380-1-0x0000000075230000-0x00000000759E0000-memory.dmp
memory/2380-2-0x0000000004FE0000-0x000000000507C000-memory.dmp
memory/2380-3-0x0000000075230000-0x00000000759E0000-memory.dmp
memory/2380-8-0x0000000075230000-0x00000000759E0000-memory.dmp
memory/2704-4-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2704-7-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2704-9-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2704-10-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2704-11-0x0000000000400000-0x0000000000420000-memory.dmp