Analysis
-
max time kernel
109s -
max time network
131s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
05-07-2020 16:04
Static task
static1
Behavioral task
behavioral1
Sample
ec7b0d2b5178c3c3dda2a31ce4022aab.exe
Resource
win7
Behavioral task
behavioral2
Sample
ec7b0d2b5178c3c3dda2a31ce4022aab.exe
Resource
win10v200430
General
-
Target
ec7b0d2b5178c3c3dda2a31ce4022aab.exe
-
Size
477KB
-
MD5
ec7b0d2b5178c3c3dda2a31ce4022aab
-
SHA1
8c5aaefe83c2c44add1c8068d82f2c7a5dc037a2
-
SHA256
a7ac6ad366a1527bb5337768e5b6543a5931793b00ab9b9d24cf82101bff8025
-
SHA512
db927b04feb1dd1453ff884eda11c5febc273847186ed780b51d6cd9a5e299c621125739a5e944c39d6ec89ae82f2b58208333087a6e9b330a4e47a9e60559af
Malware Config
Extracted
C:\Users\Admin\AppData\LocalLow\machineinfo.txt
raccoon
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Loads dropped DLL 6 IoCs
Processes:
ec7b0d2b5178c3c3dda2a31ce4022aab.exepid process 2112 ec7b0d2b5178c3c3dda2a31ce4022aab.exe 2112 ec7b0d2b5178c3c3dda2a31ce4022aab.exe 2112 ec7b0d2b5178c3c3dda2a31ce4022aab.exe 2112 ec7b0d2b5178c3c3dda2a31ce4022aab.exe 2112 ec7b0d2b5178c3c3dda2a31ce4022aab.exe 2112 ec7b0d2b5178c3c3dda2a31ce4022aab.exe -
Raccoon log file 1 IoCs
Detects a log file produced by the Raccoon Stealer.
Processes:
yara_rule raccoon_log_file -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
ec7b0d2b5178c3c3dda2a31ce4022aab.execmd.exedescription pid process target process PID 2112 wrote to memory of 3896 2112 ec7b0d2b5178c3c3dda2a31ce4022aab.exe cmd.exe PID 2112 wrote to memory of 3896 2112 ec7b0d2b5178c3c3dda2a31ce4022aab.exe cmd.exe PID 2112 wrote to memory of 3896 2112 ec7b0d2b5178c3c3dda2a31ce4022aab.exe cmd.exe PID 3896 wrote to memory of 3000 3896 cmd.exe timeout.exe PID 3896 wrote to memory of 3000 3896 cmd.exe timeout.exe PID 3896 wrote to memory of 3000 3896 cmd.exe timeout.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Checks for installed software on the system 1 TTPs 31 IoCs
Processes:
ec7b0d2b5178c3c3dda2a31ce4022aab.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key enumerated \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key opened \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key value queried \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName ec7b0d2b5178c3c3dda2a31ce4022aab.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3000 timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec7b0d2b5178c3c3dda2a31ce4022aab.exe"C:\Users\Admin\AppData\Local\Temp\ec7b0d2b5178c3c3dda2a31ce4022aab.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Checks for installed software on the system
PID:2112 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\ec7b0d2b5178c3c3dda2a31ce4022aab.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:3000