Analysis
-
max time kernel
115s -
max time network
106s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
10-08-2020 17:14
Static task
static1
Behavioral task
behavioral1
Sample
d7f91b80a7fd68240320fd69f43853c73878927e.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
d7f91b80a7fd68240320fd69f43853c73878927e.exe
Resource
win10
General
-
Target
d7f91b80a7fd68240320fd69f43853c73878927e.exe
-
Size
1.1MB
-
MD5
eaac66f1ed8fc1a960ae866012cf6437
-
SHA1
d7f91b80a7fd68240320fd69f43853c73878927e
-
SHA256
299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a
-
SHA512
0d8a0301601e9ba484649a9dddea61b091631820503b8e7069a61122adb09160db909a9361387256552e6a29ad6890571117fa9d48b12fcce7b6cf03bb28bbf9
Malware Config
Extracted
C:\Users\Admin\AppData\LocalLow\machineinfo.txt
raccoon
Signatures
-
Raccoon log file 1 IoCs
Detects a log file produced by the Raccoon Stealer.
Processes:
yara_rule raccoon_log_file -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 584 cmd.exe -
Loads dropped DLL 8 IoCs
Processes:
d7f91b80a7fd68240320fd69f43853c73878927e.exepid process 1816 d7f91b80a7fd68240320fd69f43853c73878927e.exe 1816 d7f91b80a7fd68240320fd69f43853c73878927e.exe 1816 d7f91b80a7fd68240320fd69f43853c73878927e.exe 1816 d7f91b80a7fd68240320fd69f43853c73878927e.exe 1816 d7f91b80a7fd68240320fd69f43853c73878927e.exe 1816 d7f91b80a7fd68240320fd69f43853c73878927e.exe 1816 d7f91b80a7fd68240320fd69f43853c73878927e.exe 1816 d7f91b80a7fd68240320fd69f43853c73878927e.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
JavaScript code in executable 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\nss3.dll js -
Suspicious use of SetThreadContext 1 IoCs
Processes:
d7f91b80a7fd68240320fd69f43853c73878927e.exedescription pid process target process PID 836 set thread context of 1816 836 d7f91b80a7fd68240320fd69f43853c73878927e.exe d7f91b80a7fd68240320fd69f43853c73878927e.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1060 timeout.exe -
Processes:
d7f91b80a7fd68240320fd69f43853c73878927e.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 d7f91b80a7fd68240320fd69f43853c73878927e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 d7f91b80a7fd68240320fd69f43853c73878927e.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
d7f91b80a7fd68240320fd69f43853c73878927e.exepid process 836 d7f91b80a7fd68240320fd69f43853c73878927e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
d7f91b80a7fd68240320fd69f43853c73878927e.exedescription pid process Token: SeDebugPrivilege 836 d7f91b80a7fd68240320fd69f43853c73878927e.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
d7f91b80a7fd68240320fd69f43853c73878927e.exed7f91b80a7fd68240320fd69f43853c73878927e.execmd.exedescription pid process target process PID 836 wrote to memory of 1348 836 d7f91b80a7fd68240320fd69f43853c73878927e.exe schtasks.exe PID 836 wrote to memory of 1348 836 d7f91b80a7fd68240320fd69f43853c73878927e.exe schtasks.exe PID 836 wrote to memory of 1348 836 d7f91b80a7fd68240320fd69f43853c73878927e.exe schtasks.exe PID 836 wrote to memory of 1348 836 d7f91b80a7fd68240320fd69f43853c73878927e.exe schtasks.exe PID 836 wrote to memory of 1804 836 d7f91b80a7fd68240320fd69f43853c73878927e.exe d7f91b80a7fd68240320fd69f43853c73878927e.exe PID 836 wrote to memory of 1804 836 d7f91b80a7fd68240320fd69f43853c73878927e.exe d7f91b80a7fd68240320fd69f43853c73878927e.exe PID 836 wrote to memory of 1804 836 d7f91b80a7fd68240320fd69f43853c73878927e.exe d7f91b80a7fd68240320fd69f43853c73878927e.exe PID 836 wrote to memory of 1804 836 d7f91b80a7fd68240320fd69f43853c73878927e.exe d7f91b80a7fd68240320fd69f43853c73878927e.exe PID 836 wrote to memory of 1816 836 d7f91b80a7fd68240320fd69f43853c73878927e.exe d7f91b80a7fd68240320fd69f43853c73878927e.exe PID 836 wrote to memory of 1816 836 d7f91b80a7fd68240320fd69f43853c73878927e.exe d7f91b80a7fd68240320fd69f43853c73878927e.exe PID 836 wrote to memory of 1816 836 d7f91b80a7fd68240320fd69f43853c73878927e.exe d7f91b80a7fd68240320fd69f43853c73878927e.exe PID 836 wrote to memory of 1816 836 d7f91b80a7fd68240320fd69f43853c73878927e.exe d7f91b80a7fd68240320fd69f43853c73878927e.exe PID 836 wrote to memory of 1816 836 d7f91b80a7fd68240320fd69f43853c73878927e.exe d7f91b80a7fd68240320fd69f43853c73878927e.exe PID 836 wrote to memory of 1816 836 d7f91b80a7fd68240320fd69f43853c73878927e.exe d7f91b80a7fd68240320fd69f43853c73878927e.exe PID 836 wrote to memory of 1816 836 d7f91b80a7fd68240320fd69f43853c73878927e.exe d7f91b80a7fd68240320fd69f43853c73878927e.exe PID 836 wrote to memory of 1816 836 d7f91b80a7fd68240320fd69f43853c73878927e.exe d7f91b80a7fd68240320fd69f43853c73878927e.exe PID 836 wrote to memory of 1816 836 d7f91b80a7fd68240320fd69f43853c73878927e.exe d7f91b80a7fd68240320fd69f43853c73878927e.exe PID 836 wrote to memory of 1816 836 d7f91b80a7fd68240320fd69f43853c73878927e.exe d7f91b80a7fd68240320fd69f43853c73878927e.exe PID 1816 wrote to memory of 584 1816 d7f91b80a7fd68240320fd69f43853c73878927e.exe cmd.exe PID 1816 wrote to memory of 584 1816 d7f91b80a7fd68240320fd69f43853c73878927e.exe cmd.exe PID 1816 wrote to memory of 584 1816 d7f91b80a7fd68240320fd69f43853c73878927e.exe cmd.exe PID 1816 wrote to memory of 584 1816 d7f91b80a7fd68240320fd69f43853c73878927e.exe cmd.exe PID 584 wrote to memory of 1060 584 cmd.exe timeout.exe PID 584 wrote to memory of 1060 584 cmd.exe timeout.exe PID 584 wrote to memory of 1060 584 cmd.exe timeout.exe PID 584 wrote to memory of 1060 584 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7f91b80a7fd68240320fd69f43853c73878927e.exe"C:\Users\Admin\AppData\Local\Temp\d7f91b80a7fd68240320fd69f43853c73878927e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eLQuoCLxGvR" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAD00.tmp"2⤵
- Creates scheduled task(s)
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\d7f91b80a7fd68240320fd69f43853c73878927e.exe"C:\Users\Admin\AppData\Local\Temp\d7f91b80a7fd68240320fd69f43853c73878927e.exe"2⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\d7f91b80a7fd68240320fd69f43853c73878927e.exe"C:\Users\Admin\AppData\Local\Temp\d7f91b80a7fd68240320fd69f43853c73878927e.exe"2⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\d7f91b80a7fd68240320fd69f43853c73878927e.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK4⤵
- Delays execution with timeout.exe
PID:1060
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpAD00.tmp
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\mozglue.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\msvcp140.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\nss3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\softokn3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\vcruntime140.dll
-
\Users\Admin\AppData\LocalLow\sqlite3.dll
-
memory/584-20-0x0000000000000000-mapping.dmp
-
memory/836-0-0x0000000074E00000-0x00000000754EE000-memory.dmpFilesize
6.9MB
-
memory/836-5-0x0000000005080000-0x0000000005112000-memory.dmpFilesize
584KB
-
memory/836-4-0x0000000004FD0000-0x0000000005077000-memory.dmpFilesize
668KB
-
memory/836-3-0x0000000000400000-0x0000000000404000-memory.dmpFilesize
16KB
-
memory/836-1-0x00000000000B0000-0x00000000000B1000-memory.dmpFilesize
4KB
-
memory/1060-21-0x0000000000000000-mapping.dmp
-
memory/1348-6-0x0000000000000000-mapping.dmp
-
memory/1816-10-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/1816-9-0x000000000043FA98-mapping.dmp
-
memory/1816-8-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/1924-11-0x000007FEF8550000-0x000007FEF87CA000-memory.dmpFilesize
2.5MB