Analysis
- max time kernel
110s - max time network
137s - platform
windows10_x64 - resource
win10 - submitted
24/06/2020, 14:54
Static task
static1
Behavioral task
behavioral1
Sample
bb88bf7c6da2f971c9adc22f4aa99807.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
bb88bf7c6da2f971c9adc22f4aa99807.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target bb88bf7c6da2f971c9adc22f4aa99807.exe
- Size 770KB
- Sample200624-le8hp2zhdn
- SHA256 0c34d4763fc968ccbe9f33dec2ae9e3e132a61b40ffc93cc22f337a0758c0279
- MD5 bb88bf7c6da2f971c9adc22f4aa99807
- SHA1 565722e434b1fc0cc4eae46fde60e6d004ac86ed
- SHA512 f46be6a33c0905247517a8a4f27eab3ce7b111b6b3fc7a83434ffe8a232092816d2e29b05b93246daa9d03911ef4b387fc45fcfdc492d1adbf45d63b8e1ce8f4
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\AppData\LocalLow\machineinfo.txt
-
raccoon
Ransom Note
- [Raccoon Stealer] - v1.5.11 Release Build compiled on Sat Jun 20 01:07:56 2020 Launched at: 2020.06.24 - 14:57:42 GMT Bot_ID: 664A9041-4AC4-46F3-B3DC-87DB4D57890E_Admin Running on a desktop =R=A=C=C=O=O=N= System Information: - System Language: English - System TimeZone: -0 hrs - IP: 154.61.71.51 - Location: 37.750999, -97.821999 | ?, ?, United States (?) - ComputerName: GOHCSFBB - Username: Admin - Windows version: NT 10.0 - Product name: Windows 10 Pro - System arch: x64 - CPU: Persocon Processor 2.5+ (2 cores) - RAM: 4095 MB (688 MB used) - Screen resolution: 1280x720 - Display devices: 0) Microsoft Basic Display Adapter ============
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3932 set thread context of 3936 3932 bb88bf7c6da2f971c9adc22f4aa99807.exe 69 - Program crash 3 IoCs
pid pid_target Process procid_target 1012 1492 WerFault.exe 77 852 1280 WerFault.exe 76 908 1736 WerFault.exe 78 - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3932 bb88bf7c6da2f971c9adc22f4aa99807.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3932 bb88bf7c6da2f971c9adc22f4aa99807.exe 3932 bb88bf7c6da2f971c9adc22f4aa99807.exe 3932 bb88bf7c6da2f971c9adc22f4aa99807.exe 3932 bb88bf7c6da2f971c9adc22f4aa99807.exe - Executes dropped EXE 5 IoCs
pid Process 1036 c6m2ggE5pG.exe 1280 7WqSMDy1vV.exe 1492 jALPDNYGI8.exe 1736 GRTw5K3D46.exe 3672 c6m2ggE5pG.exe - Suspicious use of WriteProcessMemory 275 IoCs
description pid Process procid_target PID 3932 wrote to memory of 3860 3932 bb88bf7c6da2f971c9adc22f4aa99807.exe 67 PID 3932 wrote to memory of 3860 3932 bb88bf7c6da2f971c9adc22f4aa99807.exe 67 PID 3932 wrote to memory of 3860 3932 bb88bf7c6da2f971c9adc22f4aa99807.exe 67 PID 3932 wrote to memory of 3904 3932 bb88bf7c6da2f971c9adc22f4aa99807.exe 68 PID 3932 wrote to memory of 3904 3932 bb88bf7c6da2f971c9adc22f4aa99807.exe 68 PID 3932 wrote to memory of 3904 3932 bb88bf7c6da2f971c9adc22f4aa99807.exe 68 PID 3932 wrote to memory of 3936 3932 bb88bf7c6da2f971c9adc22f4aa99807.exe 69 PID 3932 wrote to memory of 3936 3932 bb88bf7c6da2f971c9adc22f4aa99807.exe 69 PID 3932 wrote to memory of 3936 3932 bb88bf7c6da2f971c9adc22f4aa99807.exe 69 PID 3932 wrote to memory of 3936 3932 bb88bf7c6da2f971c9adc22f4aa99807.exe 69 PID 3932 wrote to memory of 3936 3932 bb88bf7c6da2f971c9adc22f4aa99807.exe 69 PID 3932 wrote to memory of 3936 3932 bb88bf7c6da2f971c9adc22f4aa99807.exe 69 PID 3932 wrote to memory of 3936 3932 bb88bf7c6da2f971c9adc22f4aa99807.exe 69 PID 3932 wrote to memory of 3936 3932 bb88bf7c6da2f971c9adc22f4aa99807.exe 69 PID 3932 wrote to memory of 3936 3932 bb88bf7c6da2f971c9adc22f4aa99807.exe 69 PID 3936 wrote to memory of 1036 3936 bb88bf7c6da2f971c9adc22f4aa99807.exe 75 PID 3936 wrote to memory of 1036 3936 bb88bf7c6da2f971c9adc22f4aa99807.exe 75 PID 3936 wrote to memory of 1036 3936 bb88bf7c6da2f971c9adc22f4aa99807.exe 75 PID 3936 wrote to memory of 1280 3936 bb88bf7c6da2f971c9adc22f4aa99807.exe 76 PID 3936 wrote to memory of 1280 3936 bb88bf7c6da2f971c9adc22f4aa99807.exe 76 PID 3936 wrote to memory of 1280 3936 bb88bf7c6da2f971c9adc22f4aa99807.exe 76 PID 3936 wrote to memory of 1492 3936 bb88bf7c6da2f971c9adc22f4aa99807.exe 77 PID 3936 wrote to memory of 1492 3936 bb88bf7c6da2f971c9adc22f4aa99807.exe 77 PID 3936 wrote to memory of 1492 3936 bb88bf7c6da2f971c9adc22f4aa99807.exe 77 PID 3936 wrote to memory of 1736 3936 bb88bf7c6da2f971c9adc22f4aa99807.exe 78 PID 3936 wrote to memory of 1736 3936 bb88bf7c6da2f971c9adc22f4aa99807.exe 78 PID 3936 wrote to memory of 1736 3936 bb88bf7c6da2f971c9adc22f4aa99807.exe 78 PID 3936 wrote to memory of 1844 3936 bb88bf7c6da2f971c9adc22f4aa99807.exe 79 PID 3936 wrote to memory of 1844 3936 bb88bf7c6da2f971c9adc22f4aa99807.exe 79 PID 3936 wrote to memory of 1844 3936 bb88bf7c6da2f971c9adc22f4aa99807.exe 79 PID 1844 wrote to memory of 2104 1844 cmd.exe 81 PID 1844 wrote to memory of 2104 1844 cmd.exe 81 PID 1844 wrote to memory of 2104 1844 cmd.exe 81 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 PID 1036 wrote to memory of 3672 1036 c6m2ggE5pG.exe 83 - Loads dropped DLL 8 IoCs
pid Process 3936 bb88bf7c6da2f971c9adc22f4aa99807.exe 3936 bb88bf7c6da2f971c9adc22f4aa99807.exe 3936 bb88bf7c6da2f971c9adc22f4aa99807.exe 3936 bb88bf7c6da2f971c9adc22f4aa99807.exe 3936 bb88bf7c6da2f971c9adc22f4aa99807.exe 3936 bb88bf7c6da2f971c9adc22f4aa99807.exe 3936 bb88bf7c6da2f971c9adc22f4aa99807.exe 3936 bb88bf7c6da2f971c9adc22f4aa99807.exe - Raccoon log file 1 IoCs
Detects a log file produced by the Raccoon Stealer.
yara_rule raccoon_log_file - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\LocalLow\cr6im03b56g32r\desktop.ini bb88bf7c6da2f971c9adc22f4aa99807.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Checks for installed software on the system 1 TTPs 31 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall bb88bf7c6da2f971c9adc22f4aa99807.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key value queried \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall bb88bf7c6da2f971c9adc22f4aa99807.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key enumerated \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall bb88bf7c6da2f971c9adc22f4aa99807.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName bb88bf7c6da2f971c9adc22f4aa99807.exe Key opened \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall bb88bf7c6da2f971c9adc22f4aa99807.exe - Delays execution with timeout.exe 1 IoCs
pid Process 2104 timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb88bf7c6da2f971c9adc22f4aa99807.exe"C:\Users\Admin\AppData\Local\Temp\bb88bf7c6da2f971c9adc22f4aa99807.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\bb88bf7c6da2f971c9adc22f4aa99807.exe"{path}"2⤵PID:3860
-
-
C:\Users\Admin\AppData\Local\Temp\bb88bf7c6da2f971c9adc22f4aa99807.exe"{path}"2⤵PID:3904
-
-
C:\Users\Admin\AppData\Local\Temp\bb88bf7c6da2f971c9adc22f4aa99807.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Drops desktop.ini file(s)
- Checks for installed software on the system
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\c6m2ggE5pG.exe"C:\Users\Admin\AppData\Local\Temp\c6m2ggE5pG.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\c6m2ggE5pG.exe"C:\Users\Admin\AppData\Local\Temp\c6m2ggE5pG.exe"4⤵
- Executes dropped EXE
PID:3672
-
-
-
C:\Users\Admin\AppData\Local\Temp\7WqSMDy1vV.exe"C:\Users\Admin\AppData\Local\Temp\7WqSMDy1vV.exe"3⤵
- Executes dropped EXE
PID:1280 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 8964⤵
- Program crash
PID:852
-
-
-
C:\Users\Admin\AppData\Local\Temp\jALPDNYGI8.exe"C:\Users\Admin\AppData\Local\Temp\jALPDNYGI8.exe"3⤵
- Executes dropped EXE
PID:1492 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 8964⤵
- Program crash
PID:1012
-
-
-
C:\Users\Admin\AppData\Local\Temp\GRTw5K3D46.exe"C:\Users\Admin\AppData\Local\Temp\GRTw5K3D46.exe"3⤵
- Executes dropped EXE
PID:1736 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 8964⤵
- Program crash
PID:908
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\bb88bf7c6da2f971c9adc22f4aa99807.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK4⤵
- Delays execution with timeout.exe
PID:2104
-
-
-