Overview

overview

10

Static

static

d0496b3b_b...is.exe

windows7_x64

10

d0496b3b_b...is.exe

windows10_x64

10

Analysis

  • max time kernel
    114s
  • max time network
    119s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    06/05/2021, 00:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    d0496b3b_by_Libranalysis.exe
  • Size 565KB
  • Sample210506-nbrmq3ghvx
  • SHA256 de7ccff53ca27db1ed1e3e0d0df07f2e3364ec6b7e60622dc7726cba56831eb7
  • MD5 SHA1 SHA512
Score
10/10
raccoonc021300d0074689fde86c87568e215c582272721spywarestealer

Malware Config

Extracted

Family

  • raccoon

Botnet

  • c021300d0074689fde86c87568e215c582272721

Attributes
  • url4cnc

    https://tttttt.me/ch0koalpengold

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Program crash 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d0496b3b_by_Libranalysis.exe
    "C:\Users\Admin\AppData\Local\Temp\d0496b3b_by_Libranalysis.exe"
    1⤵
    • Loads dropped DLL
    PID:4008
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 740
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2716
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 852
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:312
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 828
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:740
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 900
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3916
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1192
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3708
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1312
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3144
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1284
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:1140
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1208
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3088
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1252
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:1424
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1392
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:2852
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1208
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:2620
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1256
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:2736
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1256
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:156
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1308
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:196
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1404
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3492
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1364
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:1524
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1368
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3136
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1212
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3832
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1320
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:2076
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1288
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:1172
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1260
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:4064
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1348
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:2824
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1392
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3196
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1156
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3408
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1280
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:312
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1372
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:304
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1320
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:216
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1296
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:2664
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1396
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:1140
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1344
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3956
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1320
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:2160
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1308
      2⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:4016

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/4008-114-0x00000000022B0000-0x0000000002341000-memory.dmp
        Download

        memory/4008-115-0x0000000000400000-0x00000000004A3000-memory.dmp
        Download