Analysis
-
max time kernel
121s -
max time network
118s -
platform
windows10_x64 -
resource
win10 -
submitted
30-06-2020 06:38
Static task
static1
Behavioral task
behavioral1
Sample
3a8b3d94217aa414e12e41331720f68d.exe
Resource
win7
Behavioral task
behavioral2
Sample
3a8b3d94217aa414e12e41331720f68d.exe
Resource
win10
General
-
Target
3a8b3d94217aa414e12e41331720f68d.exe
-
Size
470KB
-
MD5
3a8b3d94217aa414e12e41331720f68d
-
SHA1
df8752a196440a4f265a8bf69e6f4ee188fadab6
-
SHA256
acab3fc36076df7b6ebddd8341fa6aba592c9be3c31946987fa1429ca8cdb452
-
SHA512
11f716187c0ed682fa973df641e6167c1b7183a3bff7bc1f0cc32eb5bd0aa533405696423d14a44e7f979080d9408a673cd236a91cd7155327ce56d8e0e57a50
Malware Config
Extracted
C:\Users\Admin\AppData\LocalLow\machineinfo.txt
raccoon
Signatures
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2568 timeout.exe -
Loads dropped DLL 8 IoCs
Processes:
3a8b3d94217aa414e12e41331720f68d.exepid process 976 3a8b3d94217aa414e12e41331720f68d.exe 976 3a8b3d94217aa414e12e41331720f68d.exe 976 3a8b3d94217aa414e12e41331720f68d.exe 976 3a8b3d94217aa414e12e41331720f68d.exe 976 3a8b3d94217aa414e12e41331720f68d.exe 976 3a8b3d94217aa414e12e41331720f68d.exe 976 3a8b3d94217aa414e12e41331720f68d.exe 976 3a8b3d94217aa414e12e41331720f68d.exe -
Raccoon log file 1 IoCs
Detects a log file produced by the Raccoon Stealer.
Processes:
yara_rule raccoon_log_file -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
3a8b3d94217aa414e12e41331720f68d.execmd.exedescription pid process target process PID 976 wrote to memory of 1772 976 3a8b3d94217aa414e12e41331720f68d.exe cmd.exe PID 976 wrote to memory of 1772 976 3a8b3d94217aa414e12e41331720f68d.exe cmd.exe PID 976 wrote to memory of 1772 976 3a8b3d94217aa414e12e41331720f68d.exe cmd.exe PID 1772 wrote to memory of 2568 1772 cmd.exe timeout.exe PID 1772 wrote to memory of 2568 1772 cmd.exe timeout.exe PID 1772 wrote to memory of 2568 1772 cmd.exe timeout.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks for installed software on the system 1 TTPs 31 IoCs
Processes:
3a8b3d94217aa414e12e41331720f68d.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall 3a8b3d94217aa414e12e41331720f68d.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall 3a8b3d94217aa414e12e41331720f68d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe Key opened \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall 3a8b3d94217aa414e12e41331720f68d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe Key enumerated \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall 3a8b3d94217aa414e12e41331720f68d.exe Key value queried \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName 3a8b3d94217aa414e12e41331720f68d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a8b3d94217aa414e12e41331720f68d.exe"C:\Users\Admin\AppData\Local\Temp\3a8b3d94217aa414e12e41331720f68d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\3a8b3d94217aa414e12e41331720f68d.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\mozglue.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\nss3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\softokn3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\softokn3.dll
-
\Users\Admin\AppData\LocalLow\sqlite3.dll
-
memory/976-0-0x00000000042B1000-0x00000000042B2000-memory.dmpFilesize
4KB
-
memory/976-1-0x00000000043A0000-0x00000000043A1000-memory.dmpFilesize
4KB
-
memory/1772-10-0x0000000000000000-mapping.dmp
-
memory/2568-11-0x0000000000000000-mapping.dmp