Analysis
-
max time kernel
139s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
18-07-2024 10:18
General
-
Target
56f01b749a568fa4b6e180484b11e69b_JaffaCakes118.exe
-
Size
356KB
-
MD5
56f01b749a568fa4b6e180484b11e69b
-
SHA1
04ebfb5a9626903d6e8418db85a5fb621f1c2a9a
-
SHA256
1d87746dfce6e0260c8c08b5d1d85ecbe200be70fa0e2dcb4effd37c47dce94d
-
SHA512
e201e2be1b374bc0464f66185a50bcc0d6ccb2a1979b3bb10e624ec92d45b6e2d053d7f57defd506e77f2417b0f247f9d6be542bfb5ef4e0bbf8c317d86f9460
-
SSDEEP
6144:EyoFxU6Sz/8bhZYBg/97eYFtKIGWbbLPCCaOJkZLv3BnqKjAucdEOjeHQfM2T:ENZSTDg/kYLKIf7P7aOJkpwucdEGeynT
Score
10/10
Malware Config
Extracted
Family
azorult
C2
http://195.245.112.115/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\56f01b749a568fa4b6e180484b11e69b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\56f01b749a568fa4b6e180484b11e69b_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\56f01b749a568fa4b6e180484b11e69b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\56f01b749a568fa4b6e180484b11e69b_JaffaCakes118.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
144KB
-
Filesize
128KB
-
Filesize
804KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
24KB