Analysis
-
max time kernel
65s -
max time network
67s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
08-08-2020 16:04
General
-
Target
8_00430000_002A000001~Rip.exe
-
Size
559KB
-
MD5
6861cce9622b99fa503f5e69b8aac8a1
-
SHA1
3a41bb30c5f63db859c8a395c3eb31de65686d2e
-
SHA256
662f468a497f6283fb91cfeab700950164ec7be98245d217bb1570622d3f8f1f
-
SHA512
2219f9987d80a24db19fe21b5a00f1e8b1c73a132e7c8bf8827703c340d14a6766ac9db6977ff4889cbd1bb301083936bcde659db70f459a2fe0adc45f8a2cbf
Score
10/10
Malware Config
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Raccoon
Simple but powerful infostealer which was very active in 2019.
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8_00430000_002A000001~Rip.exe"C:\Users\Admin\AppData\Local\Temp\8_00430000_002A000001~Rip.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 7522⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/820-0-0x00000000043A0000-0x00000000043A1000-memory.dmpFilesize
4KB
-
memory/820-1-0x0000000004AD0000-0x0000000004AD1000-memory.dmpFilesize
4KB