Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19-05-2024 05:02

General

  • Target

    58ac057e6d46663651554850aa68cc3c_JaffaCakes118.exe

  • Size

    189KB

  • MD5

    58ac057e6d46663651554850aa68cc3c

  • SHA1

    5694a5342cbc4f51cee5eba02a3d9be4de0c3d87

  • SHA256

    e22d84db06fa31b65f04c24c08a6c62360d30d021659a94beaa2f7fb71bb8598

  • SHA512

    015f990d029610cb156744e50176dde8f5e2030d19c23b666e3f9ef4572f19223d7d13061689c13f462107080f8979899a14e49cfbb5512a8bd1a3121edbdab0

  • SSDEEP

    1536:GaEdFidxG7oCOHEzeTPAEpTCdsoMK3k5WzX7j96jwBN76WJlNkVNvUCCLdUPfIvS:oUdQ7ov+eoD3k5Wzf+a3NsNMxdUYu+Q

Malware Config

Extracted

Family

azorult

C2

http://mahnatkin.site/andromache/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

Processes

  • C:\Users\Admin\AppData\Local\Temp\58ac057e6d46663651554850aa68cc3c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\58ac057e6d46663651554850aa68cc3c_JaffaCakes118.exe"
    1⤵
      PID:2856

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2856-1-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/2856-0-0x00000000003A0000-0x00000000003B0000-memory.dmp

      Filesize

      64KB

    • memory/2856-2-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/2856-3-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB