Analysis

  • max time kernel
    78s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    09-10-2020 15:31

General

  • Target

    501b75d8dbd7438757d5c35406d61e48.exe

  • Size

    734KB

  • MD5

    501b75d8dbd7438757d5c35406d61e48

  • SHA1

    abec9aaa87c6fcecddbeee721835ad1fd7aa39fe

  • SHA256

    ed9d96725b88ce0a3caee6d98c11369fb84a1d7eca3847db66abe63c49955f73

  • SHA512

    d2e7558d0b89df1cae8556c2321e83c706a6f177a31ddcb346d347ba3736d60ea4be0d9e897819f1d0855cbd79c3a7f475a634370691fc8da256f7fe804d57b8

Malware Config

Extracted

Family

raccoon

Botnet

ee3b370277b98939f8098234def6cb188c03591f

Attributes
  • url4cnc

    https://telete.in/brikitiki

rc4.plain
rc4.plain

Extracted

Family

oski

C2

letitburns.ug

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Downloads MZ/PE file
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 1 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\501b75d8dbd7438757d5c35406d61e48.exe
    "C:\Users\Admin\AppData\Local\Temp\501b75d8dbd7438757d5c35406d61e48.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3888
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Okqtlkdmt.vbs"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2204
      • C:\Users\Admin\AppData\Local\Temp\Limo.exe
        "C:\Users\Admin\AppData\Local\Temp\Limo.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2988
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Agzofy.vbs"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1968
          • C:\Users\Admin\AppData\Local\Temp\Lxcaa.exe
            "C:\Users\Admin\AppData\Local\Temp\Lxcaa.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1508
            • C:\Users\Admin\AppData\Local\Temp\Lxcaa.exe
              "C:\Users\Admin\AppData\Local\Temp\Lxcaa.exe"
              6⤵
              • Executes dropped EXE
              PID:2456
            • C:\Users\Admin\AppData\Local\Temp\Lxcaa.exe
              "C:\Users\Admin\AppData\Local\Temp\Lxcaa.exe"
              6⤵
              • Executes dropped EXE
              PID:2216
        • C:\Users\Admin\AppData\Local\Temp\Limo.exe
          "C:\Users\Admin\AppData\Local\Temp\Limo.exe"
          4⤵
          • Executes dropped EXE
          PID:1260
        • C:\Users\Admin\AppData\Local\Temp\Limo.exe
          "C:\Users\Admin\AppData\Local\Temp\Limo.exe"
          4⤵
          • Executes dropped EXE
          PID:1800
        • C:\Users\Admin\AppData\Local\Temp\Limo.exe
          "C:\Users\Admin\AppData\Local\Temp\Limo.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious use of WriteProcessMemory
          PID:784
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c taskkill /pid 784 & erase C:\Users\Admin\AppData\Local\Temp\Limo.exe & RD /S /Q C:\\ProgramData\\009135384815898\\* & exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1680
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /pid 784
              6⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1540
    • C:\Users\Admin\AppData\Local\Temp\501b75d8dbd7438757d5c35406d61e48.exe
      "C:\Users\Admin\AppData\Local\Temp\501b75d8dbd7438757d5c35406d61e48.exe"
      2⤵
        PID:2408

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Agzofy.vbs
      MD5

      e8f87f21e66219a0689dd40a12e039f1

      SHA1

      04c622cf253f1160da51a7bc71807f60ca70263c

      SHA256

      53d241b3f14e0b4f27e145b7530198868798c601093d5e2ca31c7cb67e5dfc55

      SHA512

      986ff8fc6ada5e8ea4a2b1d53a36f9ab740d0a52262e0323c4a8ddace7856d2d798586b58c55a51e6f8c7ae761ff3cabd76876b3280a2c78925c7e429418b5c3

    • C:\Users\Admin\AppData\Local\Temp\Limo.exe
      MD5

      73eb3d14503c3e556ef2f5ea8d0347cc

      SHA1

      61e367b8544a1bcb41801181a9b021b2b1739a31

      SHA256

      474314ecea6a032371a8cb8328f55d9d659470b7f71b491090b55e3be58c2937

      SHA512

      4b49ace3feba4b5ae4fb9687fd64d67682fba165ef0f7d7627e44351f68373ca0d3c4073c1acb81c252b8cc827bfc96466a29e3b87028c8a37f9fde47c2f98e6

    • C:\Users\Admin\AppData\Local\Temp\Limo.exe
      MD5

      73eb3d14503c3e556ef2f5ea8d0347cc

      SHA1

      61e367b8544a1bcb41801181a9b021b2b1739a31

      SHA256

      474314ecea6a032371a8cb8328f55d9d659470b7f71b491090b55e3be58c2937

      SHA512

      4b49ace3feba4b5ae4fb9687fd64d67682fba165ef0f7d7627e44351f68373ca0d3c4073c1acb81c252b8cc827bfc96466a29e3b87028c8a37f9fde47c2f98e6

    • C:\Users\Admin\AppData\Local\Temp\Limo.exe
      MD5

      73eb3d14503c3e556ef2f5ea8d0347cc

      SHA1

      61e367b8544a1bcb41801181a9b021b2b1739a31

      SHA256

      474314ecea6a032371a8cb8328f55d9d659470b7f71b491090b55e3be58c2937

      SHA512

      4b49ace3feba4b5ae4fb9687fd64d67682fba165ef0f7d7627e44351f68373ca0d3c4073c1acb81c252b8cc827bfc96466a29e3b87028c8a37f9fde47c2f98e6

    • C:\Users\Admin\AppData\Local\Temp\Limo.exe
      MD5

      73eb3d14503c3e556ef2f5ea8d0347cc

      SHA1

      61e367b8544a1bcb41801181a9b021b2b1739a31

      SHA256

      474314ecea6a032371a8cb8328f55d9d659470b7f71b491090b55e3be58c2937

      SHA512

      4b49ace3feba4b5ae4fb9687fd64d67682fba165ef0f7d7627e44351f68373ca0d3c4073c1acb81c252b8cc827bfc96466a29e3b87028c8a37f9fde47c2f98e6

    • C:\Users\Admin\AppData\Local\Temp\Limo.exe
      MD5

      73eb3d14503c3e556ef2f5ea8d0347cc

      SHA1

      61e367b8544a1bcb41801181a9b021b2b1739a31

      SHA256

      474314ecea6a032371a8cb8328f55d9d659470b7f71b491090b55e3be58c2937

      SHA512

      4b49ace3feba4b5ae4fb9687fd64d67682fba165ef0f7d7627e44351f68373ca0d3c4073c1acb81c252b8cc827bfc96466a29e3b87028c8a37f9fde47c2f98e6

    • C:\Users\Admin\AppData\Local\Temp\Lxcaa.exe
      MD5

      ff52a296b09b7a1806a0a2cac6098128

      SHA1

      e875bfaab02057103a252f2628fa773e0dd0318a

      SHA256

      f0127e6a8bb7480f5aed279ef700625f9c8084d430d9a84d75635b9b8fdd8b7d

      SHA512

      b5ad6bc84b330d3265e08a281e6ca4c013acf7b1930d45e61d91f0fa4b2489e540ed0e4f21baefe38cf024fd408ca3005a33295bfb77abbfed84cb75a736e480

    • C:\Users\Admin\AppData\Local\Temp\Lxcaa.exe
      MD5

      ff52a296b09b7a1806a0a2cac6098128

      SHA1

      e875bfaab02057103a252f2628fa773e0dd0318a

      SHA256

      f0127e6a8bb7480f5aed279ef700625f9c8084d430d9a84d75635b9b8fdd8b7d

      SHA512

      b5ad6bc84b330d3265e08a281e6ca4c013acf7b1930d45e61d91f0fa4b2489e540ed0e4f21baefe38cf024fd408ca3005a33295bfb77abbfed84cb75a736e480

    • C:\Users\Admin\AppData\Local\Temp\Lxcaa.exe
      MD5

      ff52a296b09b7a1806a0a2cac6098128

      SHA1

      e875bfaab02057103a252f2628fa773e0dd0318a

      SHA256

      f0127e6a8bb7480f5aed279ef700625f9c8084d430d9a84d75635b9b8fdd8b7d

      SHA512

      b5ad6bc84b330d3265e08a281e6ca4c013acf7b1930d45e61d91f0fa4b2489e540ed0e4f21baefe38cf024fd408ca3005a33295bfb77abbfed84cb75a736e480

    • C:\Users\Admin\AppData\Local\Temp\Lxcaa.exe
      MD5

      ff52a296b09b7a1806a0a2cac6098128

      SHA1

      e875bfaab02057103a252f2628fa773e0dd0318a

      SHA256

      f0127e6a8bb7480f5aed279ef700625f9c8084d430d9a84d75635b9b8fdd8b7d

      SHA512

      b5ad6bc84b330d3265e08a281e6ca4c013acf7b1930d45e61d91f0fa4b2489e540ed0e4f21baefe38cf024fd408ca3005a33295bfb77abbfed84cb75a736e480

    • C:\Users\Admin\AppData\Local\Temp\Okqtlkdmt.vbs
      MD5

      a4584cfa75a2579b73885d8c857f49fa

      SHA1

      11eed7ac4393a1c170b3b65e9252b90ddc6fb2b9

      SHA256

      9806109fc204da8de9b3533d2df60a29b6c6c1097ed27db0d000e457ab0660a5

      SHA512

      c1d8534c19572265de5a79dd9178324d931c5c4bc443010676a0b6cf54e661769278d6b6bfa0f1b7c7d4fa9491b44c34c2a49eb68002f67593a935cca636390a

    • \ProgramData\mozglue.dll
      MD5

      8f73c08a9660691143661bf7332c3c27

      SHA1

      37fa65dd737c50fda710fdbde89e51374d0c204a

      SHA256

      3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

      SHA512

      0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

    • \ProgramData\nss3.dll
      MD5

      bfac4e3c5908856ba17d41edcd455a51

      SHA1

      8eec7e888767aa9e4cca8ff246eb2aacb9170428

      SHA256

      e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

      SHA512

      2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

    • \ProgramData\sqlite3.dll
      MD5

      e477a96c8f2b18d6b5c27bde49c990bf

      SHA1

      e980c9bf41330d1e5bd04556db4646a0210f7409

      SHA256

      16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

      SHA512

      335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

    • memory/784-22-0x0000000000400000-0x0000000000434000-memory.dmp
      Filesize

      208KB

    • memory/784-26-0x0000000000400000-0x0000000000434000-memory.dmp
      Filesize

      208KB

    • memory/784-23-0x0000000000417A8B-mapping.dmp
    • memory/1508-43-0x0000000002F60000-0x0000000002F82000-memory.dmp
      Filesize

      136KB

    • memory/1508-27-0x0000000000000000-mapping.dmp
    • memory/1508-29-0x0000000073DC0000-0x00000000744AE000-memory.dmp
      Filesize

      6.9MB

    • memory/1508-30-0x0000000000D40000-0x0000000000D41000-memory.dmp
      Filesize

      4KB

    • memory/1540-42-0x0000000000000000-mapping.dmp
    • memory/1680-41-0x0000000000000000-mapping.dmp
    • memory/1968-17-0x0000000000000000-mapping.dmp
    • memory/2204-4-0x0000000000000000-mapping.dmp
    • memory/2216-49-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

    • memory/2216-46-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

    • memory/2216-47-0x000000000041A684-mapping.dmp
    • memory/2408-7-0x0000000000440102-mapping.dmp
    • memory/2408-6-0x0000000000400000-0x0000000000493000-memory.dmp
      Filesize

      588KB

    • memory/2408-9-0x0000000000400000-0x0000000000493000-memory.dmp
      Filesize

      588KB

    • memory/2988-16-0x0000000002780000-0x00000000027CC000-memory.dmp
      Filesize

      304KB

    • memory/2988-14-0x0000000000530000-0x0000000000531000-memory.dmp
      Filesize

      4KB

    • memory/2988-13-0x0000000073DC0000-0x00000000744AE000-memory.dmp
      Filesize

      6.9MB

    • memory/2988-11-0x0000000000000000-mapping.dmp
    • memory/3888-5-0x0000000004DE0000-0x0000000004DED000-memory.dmp
      Filesize

      52KB

    • memory/3888-0-0x0000000074000000-0x00000000746EE000-memory.dmp
      Filesize

      6.9MB

    • memory/3888-1-0x0000000000530000-0x0000000000531000-memory.dmp
      Filesize

      4KB

    • memory/3888-3-0x0000000004D30000-0x0000000004DD8000-memory.dmp
      Filesize

      672KB