Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    17-06-2024 12:38

General

  • Target

    b8a885b499dc0181655dd27cb4ad30a1_JaffaCakes118.exe

  • Size

    276KB

  • MD5

    b8a885b499dc0181655dd27cb4ad30a1

  • SHA1

    e2b935b7d92afb229d7a58cd2039a13941ff722c

  • SHA256

    d28d805a852b40c5ffa980386ccf5b042e21d4d4f2ed61936af647c6e0443cdb

  • SHA512

    2293d769ec5a19e0031627a9e87ba0f8bef14bb9018aad350963f88184b38ad9ddcf767bfb96c8960f98887b183cc195bb750e42daacf502994966eae8e45892

  • SSDEEP

    6144:3fN+7AOwkA+ClZPAODIwob11fPkBvpzFSKHB:0juhXQkvB

Malware Config

Extracted

Family

azorult

C2

http://91.243.81.212/loveyoupolice182938481.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b8a885b499dc0181655dd27cb4ad30a1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b8a885b499dc0181655dd27cb4ad30a1_JaffaCakes118.exe"
    1⤵
      PID:2456

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2456-1-0x0000000002410000-0x0000000002510000-memory.dmp

      Filesize

      1024KB

    • memory/2456-2-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/2456-3-0x0000000000400000-0x000000000237F000-memory.dmp

      Filesize

      31.5MB

    • memory/2456-4-0x0000000002410000-0x0000000002510000-memory.dmp

      Filesize

      1024KB

    • memory/2456-7-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/2456-5-0x0000000000400000-0x000000000237F000-memory.dmp

      Filesize

      31.5MB