Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    08-07-2020 16:48

General

  • Target

    509fbb95026308e9f02cefd909499184.exe

  • Size

    985KB

  • MD5

    509fbb95026308e9f02cefd909499184

  • SHA1

    a8c63734588c2c06211b7646f957a9d0225fdd4f

  • SHA256

    ecb89e9f66cd7f37efefec4cb211770200ccb17c810ad741cb3ec141e41c361c

  • SHA512

    3e5add9d78cb751c0a7362f7b283747e9fbe6efc6037cdfb024d527cba4279da8affdd93b0c2eb24b0a964c2a1003c0d38756786d245e1ccac1c0a9397b8f504

Malware Config

Extracted

Path

C:\Users\Admin\AppData\LocalLow\machineinfo.txt

Family

raccoon

Ransom Note
[Raccoon Stealer] - v1.5.13-af-hotfix Release Build compiled on Mon Jul 6 14:33:03 2020 Launched at: 2020.07.08 - 18:48:16 GMT Bot_ID: 58B98E61-8F0C-4164-9CA8-CBDF20304A02_Admin Running on a desktop =R=A=C=C=O=O=N= - Cookies: 0 - Passwords: 0 - Files: 0 System Information: - System Language: English - System TimeZone: -0 hrs - IP: 154.61.71.13 - Location: 37.750999, -97.821999 | ?, ?, United States (?) - ComputerName: DJRWGDLZ - Username: Admin - Windows version: NT 6.1 - Product name: Windows 7 Professional - System arch: x64 - CPU: Persocon Processor 2.5+ (2 cores) - RAM: 2047 MB (489 MB used) - Screen resolution: 1280x720 - Display devices: 0) Standard VGA Graphics Adapter ============

Signatures

  • Drops file in Windows directory 1 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 62 IoCs
  • Checks whether UAC is enabled 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Program crash 1 IoCs
  • Checks for installed software on the system 1 TTPs 62 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Program Files directory 5 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Raccoon log file 1 IoCs

    Detects a log file produced by the Raccoon Stealer.

  • Suspicious use of WriteProcessMemory 52 IoCs
  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Modifies system certificate store 10 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Delays execution with timeout.exe 1 IoCs
  • Loads dropped DLL 22 IoCs
  • Executes dropped EXE 3 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\509fbb95026308e9f02cefd909499184.exe
    "C:\Users\Admin\AppData\Local\Temp\509fbb95026308e9f02cefd909499184.exe"
    1⤵
    • Drops file in Windows directory
    • Checks for installed software on the system
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    • Loads dropped DLL
    PID:1032
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1Ldta7.html
      2⤵
      • Modifies Internet Explorer settings
      • Checks whether UAC is enabled
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:364
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:364 CREDAT:275458 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Checks whether UAC is enabled
        • Suspicious use of SetWindowsHookEx
        • Modifies system certificate store
        PID:652
    • C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
      "C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      • Executes dropped EXE
      PID:788
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 436
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Loads dropped DLL
        PID:2408
    • C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe
      "C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe"
      2⤵
      • Checks for installed software on the system
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • Loads dropped DLL
      • Executes dropped EXE
      • Checks processor information in registry
      PID:1604
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c taskkill /im wotsuper1.exe /f & erase C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1600
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /im wotsuper1.exe /f
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          • Kills process with taskkill
          PID:1120
    • C:\Windows\SysWOW64\regedit.exe
      "C:\Windows\System32\regedit.exe" \s C:\Windows\wotsuper.reg
      2⤵
      • Runs .reg file with regedit
      PID:1492
    • C:\Program Files (x86)\wotsuper\wotsuper\wotsuper2.exe
      "C:\Program Files (x86)\wotsuper\wotsuper\wotsuper2.exe"
      2⤵
      • Checks for installed software on the system
      • Suspicious use of WriteProcessMemory
      • Loads dropped DLL
      • Executes dropped EXE
      PID:1356
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Program Files (x86)\wotsuper\wotsuper\wotsuper2.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2148
        • C:\Windows\SysWOW64\timeout.exe
          timeout /T 10 /NOBREAK
          4⤵
          • Delays execution with timeout.exe
          PID:2180
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1smEq7.html
      2⤵
      • Modifies Internet Explorer settings
      • Checks whether UAC is enabled
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1796
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1796 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Checks whether UAC is enabled
        • Suspicious use of SetWindowsHookEx
        • Modifies system certificate store
        PID:1992

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe

  • C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe

  • C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe

  • C:\Program Files (x86)\wotsuper\wotsuper\wotsuper2.exe

  • C:\Program Files (x86)\wotsuper\wotsuper\wotsuper2.exe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C954CE05407CAD0B91F1461CBC854DCE

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C954CE05407CAD0B91F1461CBC854DCE

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C954CE05407CAD0B91F1461CBC854DCE

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C954CE05407CAD0B91F1461CBC854DCE

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C954CE05407CAD0B91F1461CBC854DCE

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C954CE05407CAD0B91F1461CBC854DCE

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{82351BC1-C14B-11EA-B2C5-FED453BC27D5}.dat

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ntg0b04\imagestore.dat

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G6PZ2T8A\favicon[2].ico

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\IPASX4QZ.txt

  • \Program Files (x86)\wotsuper\wotsuper\wotsuper.exe

  • \Program Files (x86)\wotsuper\wotsuper\wotsuper.exe

  • \Program Files (x86)\wotsuper\wotsuper\wotsuper.exe

  • \Program Files (x86)\wotsuper\wotsuper\wotsuper.exe

  • \Program Files (x86)\wotsuper\wotsuper\wotsuper.exe

  • \Program Files (x86)\wotsuper\wotsuper\wotsuper.exe

  • \Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe

  • \Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe

  • \Program Files (x86)\wotsuper\wotsuper\wotsuper2.exe

  • \Program Files (x86)\wotsuper\wotsuper\wotsuper2.exe

  • \ProgramData\mozglue.dll

  • \ProgramData\msvcp140.dll

  • \ProgramData\nss3.dll

  • \ProgramData\vcruntime140.dll

  • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll

  • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll

  • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\mozglue.dll

  • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\msvcp140.dll

  • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\nss3.dll

  • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\softokn3.dll

  • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\vcruntime140.dll

  • \Users\Admin\AppData\LocalLow\sqlite3.dll

  • memory/364-0-0x0000000000000000-mapping.dmp

  • memory/652-19-0x0000000000000000-mapping.dmp

  • memory/788-68-0x0000000000000000-mapping.dmp

  • memory/788-67-0x0000000000000000-mapping.dmp

  • memory/788-63-0x0000000000000000-mapping.dmp

  • memory/788-62-0x0000000000000000-mapping.dmp

  • memory/788-2-0x0000000000000000-mapping.dmp

  • memory/788-69-0x0000000000000000-mapping.dmp

  • memory/788-65-0x0000000000000000-mapping.dmp

  • memory/788-16-0x00000000005E0000-0x00000000005FE000-memory.dmp

    Filesize

    120KB

  • memory/788-64-0x0000000000000000-mapping.dmp

  • memory/788-8-0x0000000010000000-0x0000000010020000-memory.dmp

    Filesize

    128KB

  • memory/788-66-0x0000000000000000-mapping.dmp

  • memory/1120-41-0x0000000000000000-mapping.dmp

  • memory/1356-13-0x0000000000000000-mapping.dmp

  • memory/1356-18-0x0000000003880000-0x0000000003891000-memory.dmp

    Filesize

    68KB

  • memory/1356-17-0x000000000347A000-0x000000000347B000-memory.dmp

    Filesize

    4KB

  • memory/1492-10-0x0000000000000000-mapping.dmp

  • memory/1600-40-0x0000000000000000-mapping.dmp

  • memory/1604-6-0x0000000000000000-mapping.dmp

  • memory/1796-15-0x0000000000000000-mapping.dmp

  • memory/1992-20-0x0000000000000000-mapping.dmp

  • memory/2148-51-0x0000000000000000-mapping.dmp

  • memory/2180-52-0x0000000000000000-mapping.dmp

  • memory/2408-56-0x0000000002270000-0x0000000002281000-memory.dmp

    Filesize

    68KB

  • memory/2408-55-0x0000000000000000-mapping.dmp

  • memory/2408-70-0x00000000027F0000-0x0000000002801000-memory.dmp

    Filesize

    68KB