Overview

overview

10

Static

static

8

BankStatem...0.xlsb

windows7_x64

10

BankStatem...0.xlsb

windows10_x64

10

Analysis

  • max time kernel
    141s
  • max time network
    134s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    05-05-2021 23:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    BankStatement009810.xlsb

  • Size

    37KB

  • MD5

    4bedb6631269e591cdfe5c981cd4d219

  • SHA1

    46dfc240038bb75928ccc8153781a6b0e5957904

  • SHA256

    bfb37c9adc809e880f56dd10898b5425242330d6e2fa69e014a98e6dc18ce416

  • SHA512

    2adbb8c384711161029f129ddd9de0108af47245f01fbebc7670f1d864aeeb47398b5a01fed65985ca4db42f4fa6df33dd3c5e8142edf6788e569ae898d50ad6

Score
10/10
raccoonc021300d0074689fde86c87568e215c582272721spywarestealer

Malware Config

Extracted

Family

raccoon

Botnet

c021300d0074689fde86c87568e215c582272721

Attributes
  • url4cnc

    https://tttttt.me/ch0koalpengold

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Program crash 32 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\BankStatement009810.xlsb"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2256
    • C:\Users\Admin\AppData\Local\Temp\test.exe
      C:\Users\Admin\AppData\Local\Temp\test.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:576
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 748
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4076
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 760
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1300
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 912
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3940
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 928
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4056
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1200
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1340
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1224
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:3800
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1332
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:412
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1300
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:3788
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1208
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:4080
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1396
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:3184
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1288
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:1308
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1464
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:3960
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1208
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:3716
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1376
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:3136
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1448
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:412
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1556
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:3788
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1488
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:1876
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1404
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:4000
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1296
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:3672
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1468
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:3980
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1652
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:3752
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1716
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:3800
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1412
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:1288
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1500
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:4052
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1532
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:4000
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 748
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:3672
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1416
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:2252
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1524
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:1340
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1612
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:2192
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1724
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:3828
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1580
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:4020
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1684
        3⤵
        • Suspicious use of NtCreateProcessExOtherParentProcess
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:2084

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\test.exe
    MD5

    d0496b3ba31e1999123a3537275f89ed

    SHA1

    433fe5a2241f7fc909f7e5de76900c7752dd823f

    SHA256

    de7ccff53ca27db1ed1e3e0d0df07f2e3364ec6b7e60622dc7726cba56831eb7

    SHA512

    68b59d4502658f522ec72e44cc61b255299ebcafb6a497089356e4f38e08a870c357393edf6ae379b09b60cc16a0c89b9268d004e80fde03be2e5d2e2c58354a

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\test.exe
    MD5

    d0496b3ba31e1999123a3537275f89ed

    SHA1

    433fe5a2241f7fc909f7e5de76900c7752dd823f

    SHA256

    de7ccff53ca27db1ed1e3e0d0df07f2e3364ec6b7e60622dc7726cba56831eb7

    SHA512

    68b59d4502658f522ec72e44cc61b255299ebcafb6a497089356e4f38e08a870c357393edf6ae379b09b60cc16a0c89b9268d004e80fde03be2e5d2e2c58354a

    Download Submit
  • \Users\Admin\AppData\LocalLow\sqlite3.dll
    MD5

    f964811b68f9f1487c2b41e1aef576ce

    SHA1

    b423959793f14b1416bc3b7051bed58a1034025f

    SHA256

    83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

    SHA512

    565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

    Download Submit
  • memory/576-179-0x0000000000000000-mapping.dmp
    Download
  • memory/576-183-0x0000000000400000-0x00000000004A3000-memory.dmp
    Filesize

    652KB

    Download
  • memory/576-182-0x00000000020B0000-0x0000000002141000-memory.dmp
    Filesize

    580KB

    Download
  • memory/2256-117-0x00007FF85A170000-0x00007FF85A180000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2256-123-0x00007FF878D10000-0x00007FF87AC05000-memory.dmp
    Filesize

    31.0MB

    Download
  • memory/2256-122-0x00007FF87AC10000-0x00007FF87BCFE000-memory.dmp
    Filesize

    16.9MB

    Download
  • memory/2256-121-0x00007FF85A170000-0x00007FF85A180000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2256-118-0x00007FF85A170000-0x00007FF85A180000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2256-114-0x00007FF6B3180000-0x00007FF6B6736000-memory.dmp
    Filesize

    53.7MB

    Download
  • memory/2256-116-0x00007FF85A170000-0x00007FF85A180000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2256-115-0x00007FF85A170000-0x00007FF85A180000-memory.dmp
    Filesize

    64KB

    Download