Overview

overview

10

Static

static

944e549ba4...93.exe

windows7_x64

10

944e549ba4...93.exe

windows10_x64

10

Analysis

  • max time kernel
    109s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    02/07/2020, 07:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    944e549ba4db11ea3f94a2873ffbe693.exe
  • Size 836KB
  • Sample200702-eb97h33hh6
  • SHA256 a486d1f0ad1fb2729dbbcd5d3606f30566f86abd3f2d5218c11077dfeac95f0e
  • MD5 SHA1 SHA512
Score
10/10
ransomwarespywareevasiontrojanstealerraccoondiscovery

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\LocalLow\machineinfo.txt

  • raccoon

Ransom Note
  • [Raccoon Stealer] - v1.5.13-af-hotfix Release Build compiled on Tue Jun 23 14:23:14 2020 Launched at: 2020.07.02 - 07:28:58 GMT Bot_ID: BAE8C589-5DA1-4C62-BE46-F8D74908CB8C_Admin Running on a desktop =R=A=C=C=O=O=N= System Information: - System Language: English - System TimeZone: -0 hrs - IP: 154.61.71.51 - Location: 37.750999, -97.821999 | ?, ?, United States (?) - ComputerName: AVGLFESB - Username: Admin - Windows version: NT 6.1 - Product name: Windows 7 Professional - System arch: x64 - CPU: Persocon Processor 2.5+ (2 cores) - RAM: 2047 MB (405 MB used) - Screen resolution: 1280x720 - Display devices: 0) Standard VGA Graphics Adapter ============

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious use of WriteProcessMemory 365 IoCs
  • Raccoon log file 1 IoCs

    Detects a log file produced by the Raccoon Stealer.

  • Executes dropped EXE 6 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Loads dropped DLL 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Checks for installed software on the system 1 TTPs 30 IoCs
    discovery
  • Contains code to disable Windows Defender 6 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Enumerates connected drives 3 TTPs
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spyware
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 3 IoCs
  • Deletes itself 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs

Processes

  • C:\Users\Admin\AppData\Local\Temp\944e549ba4db11ea3f94a2873ffbe693.exe
    "C:\Users\Admin\AppData\Local\Temp\944e549ba4db11ea3f94a2873ffbe693.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious use of SetThreadContext
    PID:1068
    • C:\Users\Admin\AppData\Local\Temp\944e549ba4db11ea3f94a2873ffbe693.exe
      "{path}"
      2⤵
      • Suspicious use of WriteProcessMemory
      • Drops desktop.ini file(s)
      • Loads dropped DLL
      • Modifies system certificate store
      • Checks for installed software on the system
      PID:1424
      • C:\Users\Admin\AppData\Local\Temp\LIh0b1WePf.exe
        "C:\Users\Admin\AppData\Local\Temp\LIh0b1WePf.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        • Executes dropped EXE
        PID:1768
        • C:\Windows\SysWOW64\TapiUnattend.exe
          "C:\Windows\System32\TapiUnattend.exe"
          4⤵
            PID:1392
        • C:\Users\Admin\AppData\Local\Temp\C9U3tksFJY.exe
          "C:\Users\Admin\AppData\Local\Temp\C9U3tksFJY.exe"
          3⤵
          • Executes dropped EXE
          PID:1576
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lIuskVgXrJqrJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp42BA.tmp"
            4⤵
            • Creates scheduled task(s)
            PID:2180
        • C:\Users\Admin\AppData\Local\Temp\y2fiUcJb6i.exe
          "C:\Users\Admin\AppData\Local\Temp\y2fiUcJb6i.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          PID:1556
          • C:\Users\Admin\AppData\Local\Temp\y2fiUcJb6i.exe
            "{path}"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious behavior: EnumeratesProcesses
            PID:2200
            • \??\c:\windows\SysWOW64\cmstp.exe
              "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\3emzn3zl.inf
              5⤵
                PID:2340
          • C:\Users\Admin\AppData\Local\Temp\2Uy127OvN1.exe
            "C:\Users\Admin\AppData\Local\Temp\2Uy127OvN1.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            PID:1876
            • C:\Users\Admin\AppData\Local\Temp\2Uy127OvN1.exe
              "{path}"
              4⤵
              • Executes dropped EXE
              • Windows security modification
              • Modifies Windows Defender Real-time Protection settings
              PID:2160
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "powershell" Get-MpPreference -verbose
                5⤵
                  PID:2304
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\944e549ba4db11ea3f94a2873ffbe693.exe"
              3⤵
              • Suspicious use of WriteProcessMemory
              • Deletes itself
              PID:1984
              • C:\Windows\SysWOW64\timeout.exe
                timeout /T 10 /NOBREAK
                4⤵
                • Delays execution with timeout.exe
                PID:1000

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              memory/1424-2-0x0000000000400000-0x0000000000493000-memory.dmp
              Download

              memory/1424-0-0x0000000000400000-0x0000000000493000-memory.dmp
              Download

              memory/2160-104-0x0000000000400000-0x0000000000408000-memory.dmp
              Download

              memory/2160-110-0x0000000000400000-0x0000000000408000-memory.dmp
              Download

              memory/2160-117-0x0000000000400000-0x0000000000408000-memory.dmp
              Download

              memory/2200-116-0x0000000000400000-0x000000000040C000-memory.dmp
              Download

              memory/2200-115-0x0000000000400000-0x000000000040C000-memory.dmp
              Download

              memory/2200-112-0x0000000000400000-0x000000000040C000-memory.dmp
              Download