Analysis

  • max time kernel
    67s
  • max time network
    66s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    13-11-2020 15:47

General

  • Target

    c25206df37bfc9fea81145e71cc739232c877edaf5e2587c3bda548d4850b9fd.exe

  • Size

    1.1MB

  • MD5

    f3288bdca1e2d71848e4122c8237dad5

  • SHA1

    9560fb0bad1338c45b21cf9a03d75f81152e3ad5

  • SHA256

    c25206df37bfc9fea81145e71cc739232c877edaf5e2587c3bda548d4850b9fd

  • SHA512

    b447f1424bbef537995ac8502fb50db8473423edc1f5830d745e7d8c8fb93674e00e79e6f2f5ab5b1550d9f8bf9a14616b2a09a4565219242d56bdd26a258ee7

Score
10/10

Malware Config

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c25206df37bfc9fea81145e71cc739232c877edaf5e2587c3bda548d4850b9fd.exe
    "C:\Users\Admin\AppData\Local\Temp\c25206df37bfc9fea81145e71cc739232c877edaf5e2587c3bda548d4850b9fd.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1664
    • C:\Users\Admin\AppData\Local\Temp\c25206df37bfc9fea81145e71cc739232c877edaf5e2587c3bda548d4850b9fd.exe
      "C:\Users\Admin\AppData\Local\Temp\c25206df37bfc9fea81145e71cc739232c877edaf5e2587c3bda548d4850b9fd.exe"
      2⤵
      • Modifies system certificate store
      PID:2032

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1664-2-0x0000000001D00000-0x0000000001D01000-memory.dmp
    Filesize

    4KB

  • memory/2032-0-0x0000000000400000-0x0000000000493000-memory.dmp
    Filesize

    588KB

  • memory/2032-1-0x000000000043FBEE-mapping.dmp
  • memory/2032-3-0x0000000000400000-0x0000000000493000-memory.dmp
    Filesize

    588KB