Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
12-06-2024 21:27
General
-
Target
a2746a91b6fe611d1b0c0b698f372c01_JaffaCakes118.exe
-
Size
839KB
-
MD5
a2746a91b6fe611d1b0c0b698f372c01
-
SHA1
7f860635215b3d30bc4e569652f6f7269715044f
-
SHA256
bf03f7f09adbf1975ee00a1fb27430e415feda3cf15b017af6f6d06b91021185
-
SHA512
bc81eaca1eae2d0167fe3d882c16167eb1bd17b3d2d8a6fc7b72a9b6d07f533d35800306aefc8f31f55a45d8d84225ccf3e7cac7aebb1200f975209fbf726e37
-
SSDEEP
6144:V1dYD9W7LZllB02a3N1rX+o5DhoobuIJcByegHWsnDlry4LBl8Rwqiqvn4+tThZY:V1lzlC26HrN5DhoNIJ+yPHbJy4s
Malware Config
Extracted
azorult
https://techxim.com/wp-admin/admin/32/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2746a91b6fe611d1b0c0b698f372c01_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a2746a91b6fe611d1b0c0b698f372c01_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
-
Filesize
856KB
-
Filesize
584KB
-
Filesize
296KB
-
Filesize
7.7MB
-
Filesize
136KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
804KB
-
Filesize
128KB