Analysis
-
max time kernel
130s -
max time network
131s -
platform
windows10_x64 -
resource
win10 -
submitted
30-07-2020 07:35
General
-
Target
8bd5e8bba93f05411e53fc55557c5b75.exe
-
Size
1.2MB
-
MD5
8bd5e8bba93f05411e53fc55557c5b75
-
SHA1
10436c0faa6bb239e25d26375650b14c937d3c0c
-
SHA256
7fec61fcdd5cf0be25217634a1dd5f24554b45ff6cc7a0d917a31153a3b7a696
-
SHA512
ff24c75305bcaf08f284567310fa51c2ee180ec76d48b922d51cb20a921e44ad95f95dc520449fc9c59b405cd689cc7f52bf265ef4912385e71bf41e59109a2f
Malware Config
Extracted
C:\Users\Admin\AppData\LocalLow\machineinfo.txt
raccoon
Signatures
-
Raccoon log file 1 IoCs
Detects a log file produced by the Raccoon Stealer.
-
JavaScript code in executable 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Loads dropped DLL 8 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Delays execution with timeout.exe 1 IoCs
-
Raccoon
Simple but powerful infostealer which was very active in 2019.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8bd5e8bba93f05411e53fc55557c5b75.exe"C:\Users\Admin\AppData\Local\Temp\8bd5e8bba93f05411e53fc55557c5b75.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\8bd5e8bba93f05411e53fc55557c5b75.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe