Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
13-06-2024 03:25
General
-
Target
a3aa8416843adbd0800c9f673555124f_JaffaCakes118.exe
-
Size
216KB
-
MD5
a3aa8416843adbd0800c9f673555124f
-
SHA1
ec1f4681f8a4299b1e5445f34d35ed100c4ee14e
-
SHA256
79c15543e0c59f72c7f70f6616269946c81d495c1ee2fd8b92f91c22cebbdb58
-
SHA512
cda9f2e09cb909cb2c05876beb631957b6e5196d804c83ac855a8295f7eb08fad225e8df2463ea723f2dfe1c1d32526119ab5f87311bc6da6361b66adb25c85a
-
SSDEEP
3072:LTG9xkgD6w+MYCM1YEgh09Jjl6XLcnGItRsMTQcy1gg0x1QjIznJz:ne6w+MYCREUMR2cDMXcy1gg0x3J
Malware Config
Extracted
azorult
http://bullethome.cf/Mega/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Drops file in Windows directory 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3aa8416843adbd0800c9f673555124f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a3aa8416843adbd0800c9f673555124f_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a3aa8416843adbd0800c9f673555124f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a3aa8416843adbd0800c9f673555124f_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
123B
MD56bf517432f65eb7f0d18d574bf14124c
SHA15b9f37c1dd1318ebbec3bd2f07c109eb9d22c727
SHA2566e2b70dfccabf3cc651545676a3a566c9cfae03f15f772886646abce1da35b46
SHA5127b0cb8c20034585ec8bf4b45eda5eda5993a56e24931a7426dc5a9f081ec1f82545f3e26a48a4df885c8691fc6e8026d0808aebe3cc3358ba85ddca08ac4cb06
-
Filesize
232KB
-
Filesize
156KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
1.1MB