Analysis
-
max time kernel
146s -
max time network
29s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
24-07-2020 09:21
Static task
static1
Behavioral task
behavioral1
Sample
4b886233b634a40bd06d0b7198cf2c9e.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
4b886233b634a40bd06d0b7198cf2c9e.exe
Resource
win10
General
-
Target
4b886233b634a40bd06d0b7198cf2c9e.exe
-
Size
1.2MB
-
MD5
4b886233b634a40bd06d0b7198cf2c9e
-
SHA1
ea86507771820bae6ee4bc8b9da0aeaea3227a56
-
SHA256
5f7db4e2393f396aec0eb7b994acba8c784e041b943918557cd2d91c2519a341
-
SHA512
80d1784ca5be63babc2604face0a34d5aa0833a02a3b81df25802ce6fa2f57d358815a447d05e7ee17740966a307a9fcf75b099b38db8ca73061e16fdfcea8a1
Malware Config
Extracted
C:\Users\Admin\AppData\LocalLow\machineinfo.txt
raccoon
Signatures
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
4b886233b634a40bd06d0b7198cf2c9e.execmd.exedescription pid process target process PID 1108 wrote to memory of 1776 1108 4b886233b634a40bd06d0b7198cf2c9e.exe cmd.exe PID 1108 wrote to memory of 1776 1108 4b886233b634a40bd06d0b7198cf2c9e.exe cmd.exe PID 1108 wrote to memory of 1776 1108 4b886233b634a40bd06d0b7198cf2c9e.exe cmd.exe PID 1108 wrote to memory of 1776 1108 4b886233b634a40bd06d0b7198cf2c9e.exe cmd.exe PID 1776 wrote to memory of 368 1776 cmd.exe timeout.exe PID 1776 wrote to memory of 368 1776 cmd.exe timeout.exe PID 1776 wrote to memory of 368 1776 cmd.exe timeout.exe PID 1776 wrote to memory of 368 1776 cmd.exe timeout.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 368 timeout.exe -
Processes:
4b886233b634a40bd06d0b7198cf2c9e.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 4b886233b634a40bd06d0b7198cf2c9e.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 4b886233b634a40bd06d0b7198cf2c9e.exe -
Loads dropped DLL 8 IoCs
Processes:
4b886233b634a40bd06d0b7198cf2c9e.exepid process 1108 4b886233b634a40bd06d0b7198cf2c9e.exe 1108 4b886233b634a40bd06d0b7198cf2c9e.exe 1108 4b886233b634a40bd06d0b7198cf2c9e.exe 1108 4b886233b634a40bd06d0b7198cf2c9e.exe 1108 4b886233b634a40bd06d0b7198cf2c9e.exe 1108 4b886233b634a40bd06d0b7198cf2c9e.exe 1108 4b886233b634a40bd06d0b7198cf2c9e.exe 1108 4b886233b634a40bd06d0b7198cf2c9e.exe -
Raccoon log file 1 IoCs
Detects a log file produced by the Raccoon Stealer.
Processes:
yara_rule raccoon_log_file -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1776 cmd.exe -
JavaScript code in executable 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\nss3.dll js -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b886233b634a40bd06d0b7198cf2c9e.exe"C:\Users\Admin\AppData\Local\Temp\4b886233b634a40bd06d0b7198cf2c9e.exe"1⤵
- Suspicious use of WriteProcessMemory
- Modifies system certificate store
- Loads dropped DLL
PID:1108 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\4b886233b634a40bd06d0b7198cf2c9e.exe"2⤵
- Suspicious use of WriteProcessMemory
- Deletes itself
PID:1776 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:368
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\mozglue.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\msvcp140.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\nss3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\softokn3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\vcruntime140.dll
-
\Users\Admin\AppData\LocalLow\sqlite3.dll
-
memory/368-9-0x0000000000000000-mapping.dmp
-
memory/1776-8-0x0000000000000000-mapping.dmp