Analysis
-
max time kernel
16s -
max time network
114s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
16-08-2021 09:44
Static task
static1
Behavioral task
behavioral1
Sample
dc3688fa0caa86c31c983d5d531b0b85.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
dc3688fa0caa86c31c983d5d531b0b85.exe
Resource
win10v20210410
General
-
Target
dc3688fa0caa86c31c983d5d531b0b85.exe
-
Size
475KB
-
MD5
dc3688fa0caa86c31c983d5d531b0b85
-
SHA1
d5ee18441cd152a649298761d3955810f610767f
-
SHA256
1780d48983335a99ff7054cae2740df7b87e3412d46e99e6a1160769946ff2f8
-
SHA512
9a547d5eec2c091b068740227ba566c8ddda9ff29fe6f93c7f1a11d5224fc047db5d8e825d831cd4e2c741b6998bbcb98e4c91e93f4dc8490a6bb447b35cda51
Malware Config
Extracted
raccoon
cd8dc1031358b1aec55cc6bc447df1018b068607
-
url4cnc
https://telete.in/jagressor_kz
Signatures
-
Raccoon Stealer Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3908-114-0x0000000004AA0000-0x0000000004B31000-memory.dmp family_raccoon behavioral2/memory/3908-115-0x0000000000400000-0x0000000002D05000-memory.dmp family_raccoon -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 960 created 3908 960 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe -
Loads dropped DLL 1 IoCs
Processes:
dc3688fa0caa86c31c983d5d531b0b85.exepid process 3908 dc3688fa0caa86c31c983d5d531b0b85.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Program crash 32 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3816 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 3680 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 1076 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 3660 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 3132 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 2100 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 2112 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 3872 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 836 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 4028 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 2732 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 3676 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 4000 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 1432 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 3528 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 3324 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 1092 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 2112 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 1112 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 1788 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 2988 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 196 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 2136 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 2056 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 184 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 1076 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 3784 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 488 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 1168 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 3944 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 3816 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe 960 3908 WerFault.exe dc3688fa0caa86c31c983d5d531b0b85.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid process 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 1076 WerFault.exe 1076 WerFault.exe 1076 WerFault.exe 1076 WerFault.exe 1076 WerFault.exe 1076 WerFault.exe 1076 WerFault.exe 1076 WerFault.exe 1076 WerFault.exe 1076 WerFault.exe 1076 WerFault.exe 1076 WerFault.exe 1076 WerFault.exe 1076 WerFault.exe 3660 WerFault.exe 3660 WerFault.exe 3660 WerFault.exe 3660 WerFault.exe 3660 WerFault.exe 3660 WerFault.exe 3660 WerFault.exe 3660 WerFault.exe 3660 WerFault.exe 3660 WerFault.exe 3660 WerFault.exe 3660 WerFault.exe 3660 WerFault.exe 3660 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process Token: SeRestorePrivilege 3816 WerFault.exe Token: SeBackupPrivilege 3816 WerFault.exe Token: SeDebugPrivilege 3816 WerFault.exe Token: SeDebugPrivilege 3680 WerFault.exe Token: SeDebugPrivilege 1076 WerFault.exe Token: SeDebugPrivilege 3660 WerFault.exe Token: SeDebugPrivilege 3132 WerFault.exe Token: SeDebugPrivilege 2100 WerFault.exe Token: SeDebugPrivilege 2112 WerFault.exe Token: SeDebugPrivilege 3872 WerFault.exe Token: SeDebugPrivilege 836 WerFault.exe Token: SeDebugPrivilege 4028 WerFault.exe Token: SeDebugPrivilege 2732 WerFault.exe Token: SeDebugPrivilege 3676 WerFault.exe Token: SeDebugPrivilege 4000 WerFault.exe Token: SeDebugPrivilege 1432 WerFault.exe Token: SeDebugPrivilege 3528 WerFault.exe Token: SeDebugPrivilege 3324 WerFault.exe Token: SeDebugPrivilege 1092 WerFault.exe Token: SeDebugPrivilege 2112 WerFault.exe Token: SeDebugPrivilege 1112 WerFault.exe Token: SeDebugPrivilege 1788 WerFault.exe Token: SeDebugPrivilege 2988 WerFault.exe Token: SeDebugPrivilege 196 WerFault.exe Token: SeDebugPrivilege 2136 WerFault.exe Token: SeDebugPrivilege 2056 WerFault.exe Token: SeDebugPrivilege 184 WerFault.exe Token: SeDebugPrivilege 1076 WerFault.exe Token: SeDebugPrivilege 3784 WerFault.exe Token: SeDebugPrivilege 488 WerFault.exe Token: SeDebugPrivilege 1168 WerFault.exe Token: SeDebugPrivilege 3944 WerFault.exe Token: SeDebugPrivilege 3816 WerFault.exe Token: SeDebugPrivilege 960 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc3688fa0caa86c31c983d5d531b0b85.exe"C:\Users\Admin\AppData\Local\Temp\dc3688fa0caa86c31c983d5d531b0b85.exe"1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 7402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 8722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 8682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 8962⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 12162⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 13402⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 13202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 13842⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 13082⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 13882⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 12602⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 12362⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 12162⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 12602⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 13122⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 13522⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 14042⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 14402⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 13122⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 11962⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 15482⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 16562⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 16962⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 16042⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 17202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 17602⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 18002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 19122⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 19522⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 19922⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 17402⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 19442⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\LocalLow\sqlite3.dllMD5
f964811b68f9f1487c2b41e1aef576ce
SHA1b423959793f14b1416bc3b7051bed58a1034025f
SHA25683bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7
SHA512565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4
-
memory/3908-114-0x0000000004AA0000-0x0000000004B31000-memory.dmpFilesize
580KB
-
memory/3908-115-0x0000000000400000-0x0000000002D05000-memory.dmpFilesize
41.0MB