Analysis
-
max time kernel
111s -
max time network
117s -
platform
windows7_x64 -
resource
win7 -
submitted
08-08-2020 16:04
General
-
Target
8_00430000_002A000001~Rip.exe
-
Size
559KB
-
MD5
6861cce9622b99fa503f5e69b8aac8a1
-
SHA1
3a41bb30c5f63db859c8a395c3eb31de65686d2e
-
SHA256
662f468a497f6283fb91cfeab700950164ec7be98245d217bb1570622d3f8f1f
-
SHA512
2219f9987d80a24db19fe21b5a00f1e8b1c73a132e7c8bf8827703c340d14a6766ac9db6977ff4889cbd1bb301083936bcde659db70f459a2fe0adc45f8a2cbf
Score
10/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Raccoon
Simple but powerful infostealer which was very active in 2019.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8_00430000_002A000001~Rip.exe"C:\Users\Admin\AppData\Local\Temp\8_00430000_002A000001~Rip.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 3282⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/276-0-0x0000000000000000-mapping.dmp
-
memory/276-1-0x0000000002180000-0x0000000002191000-memory.dmpFilesize
68KB
-
memory/276-2-0x0000000002650000-0x0000000002661000-memory.dmpFilesize
68KB