Analysis
-
max time kernel
128s -
max time network
125s -
platform
windows10_x64 -
resource
win10 -
submitted
30-06-2020 13:33
Static task
static1
Behavioral task
behavioral1
Sample
ff47b14fae7af6baf17ccc151a0196c9.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
ff47b14fae7af6baf17ccc151a0196c9.exe
Resource
win10
General
-
Target
ff47b14fae7af6baf17ccc151a0196c9.exe
-
Size
589KB
-
MD5
ff47b14fae7af6baf17ccc151a0196c9
-
SHA1
48b087b25dec9ed2574713d786e46c47bb156a3b
-
SHA256
4911fa1954ae21c905977d4a341a7984948cad6c2fd3269871d328386a0f3344
-
SHA512
d8d35538eaaabef971fdeeac146e3f7293330aadac799227b3193dc338101783a564acab977ae475e9ab2d15c10da0beed5490352555c93f5a375eb0eacc189b
Malware Config
Extracted
C:\Users\Admin\AppData\LocalLow\machineinfo.txt
raccoon
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 3912 created 732 3912 WerFault.exe testoviyjuki.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ff47b14fae7af6baf17ccc151a0196c9.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ff47b14fae7af6baf17ccc151a0196c9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ff47b14fae7af6baf17ccc151a0196c9.exe -
Loads dropped DLL 8 IoCs
Processes:
filingood.exepid process 3296 filingood.exe 3296 filingood.exe 3296 filingood.exe 3296 filingood.exe 3296 filingood.exe 3296 filingood.exe 3296 filingood.exe 3296 filingood.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 3912 WerFault.exe Token: SeBackupPrivilege 3912 WerFault.exe Token: SeDebugPrivilege 3912 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 572 timeout.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
WerFault.exepid process 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe -
Checks for installed software on the system 1 TTPs 31 IoCs
Processes:
filingood.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName filingood.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName filingood.exe Key value queried \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName filingood.exe Key opened \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName filingood.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName filingood.exe Key enumerated \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName filingood.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName filingood.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
ff47b14fae7af6baf17ccc151a0196c9.exefilingood.execmd.exedescription pid process target process PID 3404 wrote to memory of 3296 3404 ff47b14fae7af6baf17ccc151a0196c9.exe filingood.exe PID 3404 wrote to memory of 3296 3404 ff47b14fae7af6baf17ccc151a0196c9.exe filingood.exe PID 3404 wrote to memory of 3296 3404 ff47b14fae7af6baf17ccc151a0196c9.exe filingood.exe PID 3404 wrote to memory of 732 3404 ff47b14fae7af6baf17ccc151a0196c9.exe testoviyjuki.exe PID 3404 wrote to memory of 732 3404 ff47b14fae7af6baf17ccc151a0196c9.exe testoviyjuki.exe PID 3404 wrote to memory of 732 3404 ff47b14fae7af6baf17ccc151a0196c9.exe testoviyjuki.exe PID 3296 wrote to memory of 1432 3296 filingood.exe cmd.exe PID 3296 wrote to memory of 1432 3296 filingood.exe cmd.exe PID 3296 wrote to memory of 1432 3296 filingood.exe cmd.exe PID 1432 wrote to memory of 572 1432 cmd.exe timeout.exe PID 1432 wrote to memory of 572 1432 cmd.exe timeout.exe PID 1432 wrote to memory of 572 1432 cmd.exe timeout.exe -
Executes dropped EXE 2 IoCs
Processes:
filingood.exetestoviyjuki.exepid process 3296 filingood.exe 732 testoviyjuki.exe -
Raccoon log file 1 IoCs
Detects a log file produced by the Raccoon Stealer.
Processes:
yara_rule raccoon_log_file -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3912 732 WerFault.exe testoviyjuki.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff47b14fae7af6baf17ccc151a0196c9.exe"C:\Users\Admin\AppData\Local\Temp\ff47b14fae7af6baf17ccc151a0196c9.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\indepopede\filingood.exefilingood.exe2⤵
- Loads dropped DLL
- Checks for installed software on the system
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\indepopede\filingood.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK4⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\indepopede\testoviyjuki.exetestoviyjuki.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 6843⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\indepopede\filingood.exe
-
C:\Users\Admin\AppData\Roaming\indepopede\filingood.exe
-
C:\Users\Admin\AppData\Roaming\indepopede\testoviyjuki.exe
-
C:\Users\Admin\AppData\Roaming\indepopede\testoviyjuki.exe
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\mozglue.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\nss3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\softokn3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\softokn3.dll
-
\Users\Admin\AppData\LocalLow\sqlite3.dll
-
memory/572-31-0x0000000000000000-mapping.dmp
-
memory/732-25-0x0000000000000000-mapping.dmp
-
memory/732-28-0x0000000000000000-mapping.dmp
-
memory/732-8-0x0000000000000000-mapping.dmp
-
memory/732-27-0x0000000000000000-mapping.dmp
-
memory/732-19-0x0000000004880000-0x0000000004881000-memory.dmpFilesize
4KB
-
memory/732-20-0x0000000006260000-0x0000000006261000-memory.dmpFilesize
4KB
-
memory/732-26-0x0000000000000000-mapping.dmp
-
memory/732-24-0x0000000000000000-mapping.dmp
-
memory/1432-30-0x0000000000000000-mapping.dmp
-
memory/3296-2-0x0000000000000000-mapping.dmp
-
memory/3296-5-0x0000000004452000-0x0000000004453000-memory.dmpFilesize
4KB
-
memory/3296-6-0x0000000004720000-0x0000000004721000-memory.dmpFilesize
4KB
-
memory/3404-1-0x0000000004490000-0x0000000004491000-memory.dmpFilesize
4KB
-
memory/3404-0-0x00000000041B4000-0x00000000041B5000-memory.dmpFilesize
4KB
-
memory/3912-22-0x0000000004EC0000-0x0000000004EC1000-memory.dmpFilesize
4KB
-
memory/3912-21-0x0000000004EC0000-0x0000000004EC1000-memory.dmpFilesize
4KB
-
memory/3912-29-0x00000000055F0000-0x00000000055F1000-memory.dmpFilesize
4KB