8b8524d99c41e32912669ff4be7aba713495ad3fc03e345c5a7e16d473718e48

Analysis

max time kernel
361s
max time network
1450s
platform
windows10_x64
resource
win10v20210410
submitted
06-08-2021 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Raccine/preqeq/vc_redist.x64.exe
Size

24.0MB
MD5

fb1cb75f59d98b5d1e1e31476cbe6f61
SHA1

10d155cef0ca585d94b24bc4be53c33dcbf91e7e
SHA256

a1592d3da2b27230c087a3b069409c1e82c2664b0d4c3b511701624702b2e2a3
SHA512

109f087ba2021e1ac85c404c202822f01dbc056acc933bf6ca30b67fc0f48711eb8f58ae15c4e4eb0693e80ecbd4fdf59df172244189c3f96fae1c329b77263e

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

vc_redist.x64.exe

pid process

1900 vc_redist.x64.exe
Loads dropped DLL 1 IoCs

Processes:

vc_redist.x64.exe

pid process

1900 vc_redist.x64.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1900	vc_redist.x64.exe

pid	process
1900	vc_redist.x64.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

vc_redist.x64.exe

description	pid	process	target process
PID 772 wrote to memory of 1900	772	vc_redist.x64.exe	vc_redist.x64.exe
PID 772 wrote to memory of 1900	772	vc_redist.x64.exe	vc_redist.x64.exe
PID 772 wrote to memory of 1900	772	vc_redist.x64.exe	vc_redist.x64.exe

C:\Users\Admin\AppData\Local\Temp\Raccine\preqeq\vc_redist.x64.exe
"C:\Users\Admin\AppData\Local\Temp\Raccine\preqeq\vc_redist.x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:772

C:\Windows\Temp\{263067C7-F09A-4155-B1CD-B794E5DFDB16}\.cr\vc_redist.x64.exe
"C:\Windows\Temp\{263067C7-F09A-4155-B1CD-B794E5DFDB16}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Raccine\preqeq\vc_redist.x64.exe" -burn.filehandle.attached=604 -burn.filehandle.self=608
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\{263067C7-F09A-4155-B1CD-B794E5DFDB16}\.cr\vc_redist.x64.exe
MD5
479f17e8a89247f506b5e4ab02b2ec37

SHA1
d7264231d435f0bc3bb3924585d36511cc931724

SHA256
5c63fbfc51c34baea36bcaecb32b24f445e4709bae693554736d510c43b21962

SHA512
c606dae9e7c4f0d55a72837f1a68df9dd36a1524ac4c3fd43bbb8314b90e9b0755ece7cd648477fe740e54e7c5219d7c4d39dd2b23a445bac2a17d9b54e79fa9

Download Submit
C:\Windows\Temp\{263067C7-F09A-4155-B1CD-B794E5DFDB16}\.cr\vc_redist.x64.exe
MD5
479f17e8a89247f506b5e4ab02b2ec37

SHA1
d7264231d435f0bc3bb3924585d36511cc931724

SHA256
5c63fbfc51c34baea36bcaecb32b24f445e4709bae693554736d510c43b21962

SHA512
c606dae9e7c4f0d55a72837f1a68df9dd36a1524ac4c3fd43bbb8314b90e9b0755ece7cd648477fe740e54e7c5219d7c4d39dd2b23a445bac2a17d9b54e79fa9

Download Submit
\Windows\Temp\{E1163A74-7219-4BF6-A39A-46BA6A2A5934}\.ba\wixstdba.dll
MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
memory/1900-114-0x0000000000000000-mapping.dmp

Download