Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    04-05-2024 10:59

General

  • Target

    126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe

  • Size

    1.0MB

  • MD5

    126dc3cb3bb98900e909476b955e192d

  • SHA1

    1690010021fb25ffbb3c30f108b0c6bf00a6bb03

  • SHA256

    8d19e61c0ad1199769a311aac2434dc684b32b3a7781c01eeecff12fff6eadfd

  • SHA512

    d232bd9ec17f31954af540ea5df87fac78658b0b3e843ecccaa871d6f79bded1ef9e3aa69ac90052682bcfebe0266ab0fd5f3afb99cb41ef02b7c07bf6038fec

  • SSDEEP

    24576:jF6yDgwTwbRZ8NfjTC8YnvovoP5PIUmkpk8czQB:jF6l6sv/KNS

Malware Config

Extracted

Family

azorult

C2

http://5.101.78.169/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Users\Admin\AppData\Local\Temp\126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\126dc3cb3bb98900e909476b955e192d_JaffaCakes118.exe"
      2⤵
        PID:2472

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2472-55-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2472-67-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2472-63-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2472-62-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2472-69-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2472-73-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2472-71-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2472-58-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2472-59-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2472-65-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/3020-16-0x0000000003250000-0x0000000003251000-memory.dmp

      Filesize

      4KB

    • memory/3020-11-0x0000000003250000-0x0000000003251000-memory.dmp

      Filesize

      4KB

    • memory/3020-34-0x0000000000910000-0x0000000000911000-memory.dmp

      Filesize

      4KB

    • memory/3020-33-0x00000000006E0000-0x00000000006E1000-memory.dmp

      Filesize

      4KB

    • memory/3020-32-0x0000000000700000-0x0000000000701000-memory.dmp

      Filesize

      4KB

    • memory/3020-31-0x00000000006C0000-0x00000000006C1000-memory.dmp

      Filesize

      4KB

    • memory/3020-30-0x00000000006D0000-0x00000000006D1000-memory.dmp

      Filesize

      4KB

    • memory/3020-29-0x00000000008F0000-0x00000000008F1000-memory.dmp

      Filesize

      4KB

    • memory/3020-28-0x0000000003240000-0x0000000003241000-memory.dmp

      Filesize

      4KB

    • memory/3020-27-0x0000000003240000-0x0000000003241000-memory.dmp

      Filesize

      4KB

    • memory/3020-26-0x0000000003240000-0x0000000003241000-memory.dmp

      Filesize

      4KB

    • memory/3020-25-0x0000000003240000-0x0000000003241000-memory.dmp

      Filesize

      4KB

    • memory/3020-24-0x0000000003250000-0x0000000003251000-memory.dmp

      Filesize

      4KB

    • memory/3020-23-0x0000000003250000-0x0000000003251000-memory.dmp

      Filesize

      4KB

    • memory/3020-22-0x0000000003250000-0x0000000003251000-memory.dmp

      Filesize

      4KB

    • memory/3020-21-0x0000000003250000-0x0000000003251000-memory.dmp

      Filesize

      4KB

    • memory/3020-20-0x0000000003250000-0x0000000003251000-memory.dmp

      Filesize

      4KB

    • memory/3020-19-0x0000000003250000-0x0000000003251000-memory.dmp

      Filesize

      4KB

    • memory/3020-18-0x0000000003250000-0x0000000003251000-memory.dmp

      Filesize

      4KB

    • memory/3020-17-0x0000000003250000-0x0000000003251000-memory.dmp

      Filesize

      4KB

    • memory/3020-36-0x00000000020D0000-0x00000000020D1000-memory.dmp

      Filesize

      4KB

    • memory/3020-15-0x0000000003250000-0x0000000003251000-memory.dmp

      Filesize

      4KB

    • memory/3020-14-0x0000000003250000-0x0000000003251000-memory.dmp

      Filesize

      4KB

    • memory/3020-13-0x0000000003250000-0x0000000003251000-memory.dmp

      Filesize

      4KB

    • memory/3020-12-0x00000000003B0000-0x00000000003B1000-memory.dmp

      Filesize

      4KB

    • memory/3020-35-0x0000000003240000-0x0000000003241000-memory.dmp

      Filesize

      4KB

    • memory/3020-10-0x0000000003250000-0x0000000003251000-memory.dmp

      Filesize

      4KB

    • memory/3020-9-0x0000000003250000-0x0000000003251000-memory.dmp

      Filesize

      4KB

    • memory/3020-8-0x00000000003C0000-0x00000000003C1000-memory.dmp

      Filesize

      4KB

    • memory/3020-7-0x0000000000390000-0x0000000000391000-memory.dmp

      Filesize

      4KB

    • memory/3020-6-0x00000000002A0000-0x00000000002A1000-memory.dmp

      Filesize

      4KB

    • memory/3020-5-0x0000000000290000-0x0000000000291000-memory.dmp

      Filesize

      4KB

    • memory/3020-4-0x0000000000270000-0x0000000000271000-memory.dmp

      Filesize

      4KB

    • memory/3020-3-0x0000000000280000-0x0000000000281000-memory.dmp

      Filesize

      4KB

    • memory/3020-2-0x00000000003A0000-0x00000000003A1000-memory.dmp

      Filesize

      4KB

    • memory/3020-45-0x00000000003F0000-0x00000000003F1000-memory.dmp

      Filesize

      4KB

    • memory/3020-47-0x0000000000250000-0x0000000000251000-memory.dmp

      Filesize

      4KB

    • memory/3020-46-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/3020-44-0x0000000003240000-0x0000000003242000-memory.dmp

      Filesize

      8KB

    • memory/3020-43-0x00000000020E0000-0x00000000020E1000-memory.dmp

      Filesize

      4KB

    • memory/3020-42-0x0000000003250000-0x0000000003251000-memory.dmp

      Filesize

      4KB

    • memory/3020-41-0x00000000020C0000-0x00000000020C1000-memory.dmp

      Filesize

      4KB

    • memory/3020-40-0x00000000020B0000-0x00000000020B1000-memory.dmp

      Filesize

      4KB

    • memory/3020-48-0x0000000000400000-0x00000000005B4000-memory.dmp

      Filesize

      1.7MB

    • memory/3020-49-0x00000000002B0000-0x000000000030F000-memory.dmp

      Filesize

      380KB

    • memory/3020-51-0x0000000003240000-0x0000000003241000-memory.dmp

      Filesize

      4KB

    • memory/3020-37-0x0000000002090000-0x0000000002091000-memory.dmp

      Filesize

      4KB

    • memory/3020-38-0x0000000000950000-0x0000000000951000-memory.dmp

      Filesize

      4KB

    • memory/3020-39-0x00000000020A0000-0x00000000020A1000-memory.dmp

      Filesize

      4KB

    • memory/3020-1-0x00000000002B0000-0x000000000030F000-memory.dmp

      Filesize

      380KB

    • memory/3020-0-0x0000000000400000-0x00000000005B4000-memory.dmp

      Filesize

      1.7MB

    • memory/3020-70-0x0000000000400000-0x00000000005B4000-memory.dmp

      Filesize

      1.7MB