Malware Analysis Report

2024-08-06 13:24

Sample ID 240615-k63a2svfka
Target adb4871da80855607760738d9d7670c2_JaffaCakes118
SHA256 e5e84f76ada6cdc1d014815b75a2508fbeba5a08372bd1d027b987295ef654a9
Tags
azorult modiloader infostealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e5e84f76ada6cdc1d014815b75a2508fbeba5a08372bd1d027b987295ef654a9

Threat Level: Known bad

The file adb4871da80855607760738d9d7670c2_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

azorult modiloader infostealer trojan

Azorult

ModiLoader, DBatLoader

ModiLoader First Stage

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-15 09:13

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 09:13

Reported

2024-06-15 09:16

Platform

win7-20240508-en

Max time kernel

121s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\adb4871da80855607760738d9d7670c2_JaffaCakes118.exe"

Signatures

Azorult

trojan infostealer azorult

ModiLoader, DBatLoader

trojan modiloader

ModiLoader First Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\msdos.scr N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\adb4871da80855607760738d9d7670c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\adb4871da80855607760738d9d7670c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\adb4871da80855607760738d9d7670c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\adb4871da80855607760738d9d7670c2_JaffaCakes118.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2980 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\adb4871da80855607760738d9d7670c2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\msdos.scr
PID 2980 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\adb4871da80855607760738d9d7670c2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\msdos.scr
PID 2980 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\adb4871da80855607760738d9d7670c2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\msdos.scr
PID 2980 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\adb4871da80855607760738d9d7670c2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\msdos.scr

Processes

C:\Users\Admin\AppData\Local\Temp\adb4871da80855607760738d9d7670c2_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\adb4871da80855607760738d9d7670c2_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\msdos.scr

"C:\Users\Admin\AppData\Local\Temp\msdos.scr" /S

Network

Country Destination Domain Proto
US 8.8.8.8:53 francearefrogs.xyz udp
US 8.8.8.8:53 francearefrogs.xyz udp

Files

\Users\Admin\AppData\Local\Temp\msdos.scr

MD5 55d29aedcaa8857c64b606d367c560b5
SHA1 02d6cb238a3ae15e9a8c1178d5d63d437b6f798c
SHA256 3870b801527efb88b26364ac518c682ebb5593096efb26b609be56737767d731
SHA512 38bbd1ef87d754ae06f0e44e0c7d065b5044aa666fa9e4e8fb0d9e390a8861a6ce4bd2b15d1c47d9c1a9bf0dc4701b5aeed2116963c2d451c9ff0b5553a86f39

memory/1200-18-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/1200-19-0x0000000000400000-0x0000000000486000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ms

MD5 443ac263ce403bc1233f82b1ecdcd33a
SHA1 baaf21d078f9de6ec0b16b17c9b9e3240352164a
SHA256 9743874e33d5932c767cedea36218005b47204eabd57d00882245dd72ebf4fda
SHA512 b70f30a65bcf439ab6bafadabdbf92c7c864fe02308da6c5264c3f2e7a125d16d0791dd3f8fe0352f21d5cea55a70a2aa6bdd7c3316707b65958dd7b2926efb1

memory/1200-21-0x0000000000400000-0x0000000000486000-memory.dmp

memory/1200-22-0x00000000001B0000-0x00000000001B1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-15 09:13

Reported

2024-06-15 09:16

Platform

win10v2004-20240611-en

Max time kernel

93s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\adb4871da80855607760738d9d7670c2_JaffaCakes118.exe"

Signatures

Azorult

trojan infostealer azorult

ModiLoader, DBatLoader

trojan modiloader

ModiLoader First Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\adb4871da80855607760738d9d7670c2_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\msdos.scr N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 436 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\adb4871da80855607760738d9d7670c2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\msdos.scr
PID 436 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\adb4871da80855607760738d9d7670c2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\msdos.scr
PID 436 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\adb4871da80855607760738d9d7670c2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\msdos.scr

Processes

C:\Users\Admin\AppData\Local\Temp\adb4871da80855607760738d9d7670c2_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\adb4871da80855607760738d9d7670c2_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\msdos.scr

"C:\Users\Admin\AppData\Local\Temp\msdos.scr" /S

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 francearefrogs.xyz udp
US 8.8.8.8:53 francearefrogs.xyz udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\msdos.scr

MD5 55d29aedcaa8857c64b606d367c560b5
SHA1 02d6cb238a3ae15e9a8c1178d5d63d437b6f798c
SHA256 3870b801527efb88b26364ac518c682ebb5593096efb26b609be56737767d731
SHA512 38bbd1ef87d754ae06f0e44e0c7d065b5044aa666fa9e4e8fb0d9e390a8861a6ce4bd2b15d1c47d9c1a9bf0dc4701b5aeed2116963c2d451c9ff0b5553a86f39

memory/4312-8-0x00000000020D0000-0x00000000020D1000-memory.dmp

memory/4312-9-0x0000000000400000-0x0000000000486000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ms

MD5 443ac263ce403bc1233f82b1ecdcd33a
SHA1 baaf21d078f9de6ec0b16b17c9b9e3240352164a
SHA256 9743874e33d5932c767cedea36218005b47204eabd57d00882245dd72ebf4fda
SHA512 b70f30a65bcf439ab6bafadabdbf92c7c864fe02308da6c5264c3f2e7a125d16d0791dd3f8fe0352f21d5cea55a70a2aa6bdd7c3316707b65958dd7b2926efb1

memory/4312-11-0x0000000000400000-0x0000000000486000-memory.dmp