Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    22-05-2024 20:20

General

  • Target

    687f35dad4720227f2be64cb57ef3003_JaffaCakes118.exe

  • Size

    193KB

  • MD5

    687f35dad4720227f2be64cb57ef3003

  • SHA1

    888976af8518ceb332f054e85723471e25fd9520

  • SHA256

    384ea7fdb3c13393a35823806a05ccdd99aa12b39708fc9b5bcd540cde4b4620

  • SHA512

    2771e363d2b0b91987875d2dc21c86065ebb5ecb2e8418879894b3387bc423ff1c479c6e723d642e5879b30da3be8fe28b498a9b479954c30f12c75d6305b6c2

  • SSDEEP

    3072:U3ZcWhEYZoNPuEs3o7tj5L0qcW9FYZHEvjepNioLVtOM5r92A7:gZcgAs3HW9Gk70BLvOW93

Malware Config

Extracted

Family

azorult

C2

http://difoxerit.com/inhanj/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

Processes

  • C:\Users\Admin\AppData\Local\Temp\687f35dad4720227f2be64cb57ef3003_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\687f35dad4720227f2be64cb57ef3003_JaffaCakes118.exe"
    1⤵
      PID:2108

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2108-1-0x0000000000510000-0x0000000000610000-memory.dmp

      Filesize

      1024KB

    • memory/2108-2-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/2108-3-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

    • memory/2108-4-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB