Analysis

  • max time kernel
    23s
  • max time network
    139s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    08-08-2021 17:16

General

  • Target

    usfive_20210808-184641.exe

  • Size

    512KB

  • MD5

    f61ebb45ff423851fc48133bbcf49a83

  • SHA1

    71ac9fe46382fff620ffccb01d13c91233519f31

  • SHA256

    7e3b21ad9998cf8cb40f6471307c42d81f7ade43d52db956205cb251e3ba2579

  • SHA512

    07444eb698d93411cf289a5154b9989f3960bedbaf114d4325fb7217222ce9634691d5b4f9549ca4d77a5ecaf1e91ff152278b7cc5236476bd3680de1e7b64e6

Malware Config

Extracted

Family

raccoon

Botnet

c58b0b3f1f90ad7552aaf8e84180b7580f397001

Attributes
  • url4cnc

    https://telete.in/h_electricryptors2

rc4.plain
rc4.plain

Signatures

  • DarkVNC

    DarkVNC is a malicious version of the famous VNC software.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Raccoon Stealer Payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • DarkVNC Payload 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\usfive_20210808-184641.exe
    "C:\Users\Admin\AppData\Local\Temp\usfive_20210808-184641.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:652
    • C:\Users\Admin\AppData\Local\Temp\6aFJzad59i.exe
      "C:\Users\Admin\AppData\Local\Temp\6aFJzad59i.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:3180
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe
        3⤵
          PID:816
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 484
          3⤵
          • Suspicious use of NtCreateProcessExOtherParentProcess
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3876
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\usfive_20210808-184641.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3084
        • C:\Windows\SysWOW64\timeout.exe
          timeout /T 10 /NOBREAK
          3⤵
          • Delays execution with timeout.exe
          PID:1424

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/652-115-0x0000000000400000-0x0000000002CB6000-memory.dmp

      Filesize

      40.7MB

    • memory/652-114-0x0000000004A60000-0x0000000004AF3000-memory.dmp

      Filesize

      588KB

    • memory/816-131-0x0000020855390000-0x000002085545A000-memory.dmp

      Filesize

      808KB

    • memory/816-130-0x0000020855120000-0x0000020855149000-memory.dmp

      Filesize

      164KB

    • memory/3180-127-0x00000000048D0000-0x0000000004958000-memory.dmp

      Filesize

      544KB

    • memory/3180-129-0x0000000000400000-0x0000000002CA6000-memory.dmp

      Filesize

      40.6MB