Overview

overview

10

Static

static

b557b4af47...9c.exe

windows7_x64

10

b557b4af47...9c.exe

windows10_x64

10

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    15-11-2020 23:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b557b4af472ef5827704d4e22fcfc80751f4de5024a09b6d72c62827af963f9c.exe

  • Size

    487KB

  • MD5

    0a2025cfbd9c9fae89bb0163ec1fc8eb

  • SHA1

    8b9d5262b31d8d0008765681a6e386597ce1b2e9

  • SHA256

    b557b4af472ef5827704d4e22fcfc80751f4de5024a09b6d72c62827af963f9c

  • SHA512

    7da2c4b7fdf12aef53bd4c8c6603530d84a7b5dde1f6d2ccbc8fa2a6da6d6e1aed405f3084a3933956c173720ead3b5278c6ff7791be7c06e13e660c0989b711

Score
10/10
raccoonstealer

Malware Config

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon
  • Program crash 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 84 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b557b4af472ef5827704d4e22fcfc80751f4de5024a09b6d72c62827af963f9c.exe
    "C:\Users\Admin\AppData\Local\Temp\b557b4af472ef5827704d4e22fcfc80751f4de5024a09b6d72c62827af963f9c.exe"
    1⤵
      PID:648
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 740
        2⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2412
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 812
        2⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3768
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 892
        2⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:504
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 852
        2⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:200
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 1188
        2⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1404
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 1272
        2⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:2724

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/200-17-0x0000000005590000-0x0000000005591000-memory.dmp
      Filesize

      4KB

      Download
    • memory/200-14-0x0000000005060000-0x0000000005061000-memory.dmp
      Filesize

      4KB

      Download
    • memory/504-13-0x0000000004950000-0x0000000004951000-memory.dmp
      Filesize

      4KB

      Download
    • memory/504-10-0x0000000004610000-0x0000000004611000-memory.dmp
      Filesize

      4KB

      Download
    • memory/648-1-0x00000000012C0000-0x00000000012C1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/648-0-0x0000000000E1F000-0x0000000000E20000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1404-21-0x00000000058B0000-0x00000000058B1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1404-18-0x0000000005080000-0x0000000005081000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2412-3-0x00000000049B0000-0x00000000049B1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2412-5-0x0000000004EE0000-0x0000000004EE1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2412-2-0x00000000049B0000-0x00000000049B1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2724-22-0x0000000004610000-0x0000000004611000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2724-25-0x0000000004E40000-0x0000000004E41000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3768-9-0x00000000056E0000-0x00000000056E1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3768-6-0x00000000051B0000-0x00000000051B1000-memory.dmp
      Filesize

      4KB

      Download