Overview

overview

10

Static

static

3

a3aa841684...18.exe

windows7-x64

10

a3aa841684...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2024 03:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a3aa8416843adbd0800c9f673555124f_JaffaCakes118.exe

  • Size

    216KB

  • MD5

    a3aa8416843adbd0800c9f673555124f

  • SHA1

    ec1f4681f8a4299b1e5445f34d35ed100c4ee14e

  • SHA256

    79c15543e0c59f72c7f70f6616269946c81d495c1ee2fd8b92f91c22cebbdb58

  • SHA512

    cda9f2e09cb909cb2c05876beb631957b6e5196d804c83ac855a8295f7eb08fad225e8df2463ea723f2dfe1c1d32526119ab5f87311bc6da6361b66adb25c85a

  • SSDEEP

    3072:LTG9xkgD6w+MYCM1YEgh09Jjl6XLcnGItRsMTQcy1gg0x1QjIznJz:ne6w+MYCREUMR2cDMXcy1gg0x3J

Score
10/10
azorultinfostealertrojan

Malware Config

Extracted

Family

azorult

C2

http://bullethome.cf/Mega/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a3aa8416843adbd0800c9f673555124f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a3aa8416843adbd0800c9f673555124f_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3052
    • C:\Users\Admin\AppData\Local\Temp\a3aa8416843adbd0800c9f673555124f_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\a3aa8416843adbd0800c9f673555124f_JaffaCakes118.exe"
      2⤵
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      PID:1540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\win.ini
    Filesize

    509B

    MD5

    d2a2412bddba16d60ec63bd9550d933f

    SHA1

    deb3d3bdc9055f0b4909b31d3048446848fae0e1

    SHA256

    79ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a

    SHA512

    8fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31

    Download Submit

  • memory/1540-9-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/1540-11-0x0000000077610000-0x00000000777B9000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/1540-14-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/3052-3-0x0000000077611000-0x0000000077712000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/3052-4-0x0000000077610000-0x00000000777B9000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/3052-12-0x0000000077800000-0x00000000778D6000-memory.dmp

    Filesize

    856KB

    Download