Analysis
-
max time kernel
122s -
max time network
138s -
platform
windows10_x64 -
resource
win10 -
submitted
30-06-2020 05:24
Static task
static1
Behavioral task
behavioral1
Sample
08a433dcb4d318008eb98a700a267f43.exe
Resource
win7
Behavioral task
behavioral2
Sample
08a433dcb4d318008eb98a700a267f43.exe
Resource
win10
General
-
Target
08a433dcb4d318008eb98a700a267f43.exe
-
Size
580KB
-
MD5
08a433dcb4d318008eb98a700a267f43
-
SHA1
e920ca841d6c2ea3f7a5d15b7ac49e9e1d3442cd
-
SHA256
b47f74419de5db79da95d6d39d6e7e0da43a2bb2dc5770a0ee3715bcb2d76299
-
SHA512
61895c47d22e1f02b668f3be1e1484d88ca3ce7d5a59ace5a8c4efbfd89f97bf7d1ea625df924504f3c845f1644078f6024383373d786e230bee8f40b1000089
Malware Config
Extracted
C:\Users\Admin\AppData\LocalLow\machineinfo.txt
raccoon
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
08a433dcb4d318008eb98a700a267f43.exefilingood.execmd.exedescription pid process target process PID 3404 wrote to memory of 3296 3404 08a433dcb4d318008eb98a700a267f43.exe filingood.exe PID 3404 wrote to memory of 3296 3404 08a433dcb4d318008eb98a700a267f43.exe filingood.exe PID 3404 wrote to memory of 3296 3404 08a433dcb4d318008eb98a700a267f43.exe filingood.exe PID 3296 wrote to memory of 3716 3296 filingood.exe cmd.exe PID 3296 wrote to memory of 3716 3296 filingood.exe cmd.exe PID 3296 wrote to memory of 3716 3296 filingood.exe cmd.exe PID 3716 wrote to memory of 2920 3716 cmd.exe timeout.exe PID 3716 wrote to memory of 2920 3716 cmd.exe timeout.exe PID 3716 wrote to memory of 2920 3716 cmd.exe timeout.exe -
Executes dropped EXE 1 IoCs
Processes:
filingood.exepid process 3296 filingood.exe -
Raccoon log file 1 IoCs
Detects a log file produced by the Raccoon Stealer.
Processes:
yara_rule raccoon_log_file -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2920 timeout.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Loads dropped DLL 8 IoCs
Processes:
filingood.exepid process 3296 filingood.exe 3296 filingood.exe 3296 filingood.exe 3296 filingood.exe 3296 filingood.exe 3296 filingood.exe 3296 filingood.exe 3296 filingood.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
08a433dcb4d318008eb98a700a267f43.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 08a433dcb4d318008eb98a700a267f43.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 08a433dcb4d318008eb98a700a267f43.exe -
Checks for installed software on the system 1 TTPs 31 IoCs
Processes:
filingood.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName filingood.exe Key value queried \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe\DisplayName filingood.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName filingood.exe Key opened \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName filingood.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName filingood.exe Key enumerated \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName filingood.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08a433dcb4d318008eb98a700a267f43.exe"C:\Users\Admin\AppData\Local\Temp\08a433dcb4d318008eb98a700a267f43.exe"1⤵
- Suspicious use of WriteProcessMemory
- Checks processor information in registry
-
C:\Users\Admin\AppData\Roaming\indepopede\filingood.exefilingood.exe2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Loads dropped DLL
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\indepopede\filingood.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK4⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\indepopede\filingood.exe
-
C:\Users\Admin\AppData\Roaming\indepopede\filingood.exe
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\mozglue.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\nss3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\softokn3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\softokn3.dll
-
\Users\Admin\AppData\LocalLow\sqlite3.dll
-
memory/2920-16-0x0000000000000000-mapping.dmp
-
memory/3296-6-0x00000000044B0000-0x00000000044B1000-memory.dmpFilesize
4KB
-
memory/3296-5-0x00000000043C1000-0x00000000043C2000-memory.dmpFilesize
4KB
-
memory/3296-2-0x0000000000000000-mapping.dmp
-
memory/3404-0-0x0000000004384000-0x0000000004385000-memory.dmpFilesize
4KB
-
memory/3404-1-0x0000000004480000-0x0000000004481000-memory.dmpFilesize
4KB
-
memory/3716-15-0x0000000000000000-mapping.dmp