Analysis

  • max time kernel
    22s
  • max time network
    43s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    03-07-2021 10:23

General

  • Target

    usfive_20210703-095023.exe

  • Size

    466KB

  • MD5

    d6b6f1ab249f9528546460eee71d431b

  • SHA1

    3110e71aab808c5dffe7be938187681f1a5da029

  • SHA256

    80dfb1cf38ee1f0a1714327db6ba9f6ddb8195aedf6c7f63a73cfafe66896aad

  • SHA512

    f26a6e4b134f58031eb53ae84798c9c2a7adec6bac79f90932429aac35ec805c5f6814515be358d578717bd6506ddb476e91ec4f420992a17b68fca0f26cd969

Malware Config

Extracted

Family

raccoon

Botnet

7ea5512058d479def2eeb58bd2231423ad2fdf37

Attributes
  • url4cnc

    https://telete.in/h_electricryptors2

rc4.plain
rc4.plain

Signatures

  • DarkVNC

    DarkVNC is a malicious version of the famous VNC software.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • DarkVNC Payload 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\usfive_20210703-095023.exe
    "C:\Users\Admin\AppData\Local\Temp\usfive_20210703-095023.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1836
    • C:\Users\Admin\AppData\Local\Temp\2v0kspfHSJ.exe
      "C:\Users\Admin\AppData\Local\Temp\2v0kspfHSJ.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:552
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe
        3⤵
          PID:612
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\usfive_20210703-095023.exe"
        2⤵
        • Deletes itself
        • Suspicious use of WriteProcessMemory
        PID:1904
        • C:\Windows\SysWOW64\timeout.exe
          timeout /T 10 /NOBREAK
          3⤵
          • Delays execution with timeout.exe
          PID:780

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/552-79-0x0000000000340000-0x00000000003C8000-memory.dmp

      Filesize

      544KB

    • memory/552-80-0x0000000000400000-0x000000000060F000-memory.dmp

      Filesize

      2.1MB

    • memory/612-78-0x000007FEFBB41000-0x000007FEFBB43000-memory.dmp

      Filesize

      8KB

    • memory/612-81-0x00000000000F0000-0x00000000000F1000-memory.dmp

      Filesize

      4KB

    • memory/612-82-0x0000000001CF0000-0x0000000001DBA000-memory.dmp

      Filesize

      808KB

    • memory/1836-61-0x0000000000400000-0x000000000061F000-memory.dmp

      Filesize

      2.1MB

    • memory/1836-59-0x0000000075721000-0x0000000075723000-memory.dmp

      Filesize

      8KB

    • memory/1836-60-0x0000000000300000-0x0000000000391000-memory.dmp

      Filesize

      580KB