Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    10-06-2024 23:46

General

  • Target

    9c5806674011b297ac84f96f3a16f1e9_JaffaCakes118.exe

  • Size

    277KB

  • MD5

    9c5806674011b297ac84f96f3a16f1e9

  • SHA1

    6536fe0726720cb75c2848e3f3aa5cb5d33bc574

  • SHA256

    aa05599c5095f883b88f8600a00d32efa7b7e64d10bfccb0d25300177f3bab26

  • SHA512

    17f68127632db1c999a58fb3ca7f5b7a72fe06042979a921a0c8ac4621b3e4673801043e55d142a62f19ed8b73a80dd35c78a3680ef6de15df5fc4d3af7a68b5

  • SSDEEP

    6144:PK+RLaDXoJ4dbhR9S4A02ZV2hBYHFyUNeBw:PKEkXPdbhPS4AyuN/

Malware Config

Extracted

Family

azorult

C2

http://217.8.117.19/22C60E11-E977-4823-B41A-E220438E8823/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

Processes

  • C:\Users\Admin\AppData\Local\Temp\9c5806674011b297ac84f96f3a16f1e9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9c5806674011b297ac84f96f3a16f1e9_JaffaCakes118.exe"
    1⤵
      PID:1728

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1728-2-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1728-1-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/1728-3-0x0000000000400000-0x00000000004A6000-memory.dmp

      Filesize

      664KB

    • memory/1728-6-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1728-5-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/1728-9-0x0000000000400000-0x00000000004A6000-memory.dmp

      Filesize

      664KB

    • memory/1728-11-0x0000000000400000-0x00000000004A6000-memory.dmp

      Filesize

      664KB

    • memory/1728-12-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB