Analysis

  • max time kernel
    70s
  • max time network
    128s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    23-08-2021 13:56

General

  • Target

    e8e31ad00eb7d6e4124e0d9dcd2a2e4ca20afa68007c0e655ae8cc5ca4bfdad9.exe

  • Size

    1.2MB

  • MD5

    59b1a1f58b7ca014b73a2eebda7eae53

  • SHA1

    553c47a56200b6d957e0ce1ea126399831012c5d

  • SHA256

    e8e31ad00eb7d6e4124e0d9dcd2a2e4ca20afa68007c0e655ae8cc5ca4bfdad9

  • SHA512

    8eb261de8b0396535f2f25d620e504961b79c252769634afe65aa1aff70792a91d183036ace376c8b1030186f270886c853458667f89296b5995887478072db0

Malware Config

Extracted

Family

raccoon

Botnet

c81fb6015c832710f869f6911e1aec18747e0184

Attributes
  • url4cnc

    https://telete.in/brikitiki

rc4.plain
rc4.plain

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Extracted

Family

oski

C2

gordonhk.ac.ug

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 1 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e8e31ad00eb7d6e4124e0d9dcd2a2e4ca20afa68007c0e655ae8cc5ca4bfdad9.exe
    "C:\Users\Admin\AppData\Local\Temp\e8e31ad00eb7d6e4124e0d9dcd2a2e4ca20afa68007c0e655ae8cc5ca4bfdad9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3608
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Nrwclnomc.vbs"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2152
      • C:\Users\Admin\AppData\Local\Temp\Bwxgmfnmlwaconsoleapp3.exe
        "C:\Users\Admin\AppData\Local\Temp\Bwxgmfnmlwaconsoleapp3.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3864
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Eyyozukgtsxfcpfq.vbs"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4012
          • C:\Users\Admin\AppData\Local\Temp\Gqgistxtagnubptvmqtbtconsoleapp9.exe
            "C:\Users\Admin\AppData\Local\Temp\Gqgistxtagnubptvmqtbtconsoleapp9.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3496
            • C:\Users\Admin\AppData\Local\Temp\Gqgistxtagnubptvmqtbtconsoleapp9.exe
              C:\Users\Admin\AppData\Local\Temp\Gqgistxtagnubptvmqtbtconsoleapp9.exe
              6⤵
              • Executes dropped EXE
              PID:1456
            • C:\Users\Admin\AppData\Local\Temp\Gqgistxtagnubptvmqtbtconsoleapp9.exe
              C:\Users\Admin\AppData\Local\Temp\Gqgistxtagnubptvmqtbtconsoleapp9.exe
              6⤵
              • Executes dropped EXE
              • Checks processor information in registry
              • Suspicious use of WriteProcessMemory
              PID:2388
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c taskkill /pid 2388 & erase C:\Users\Admin\AppData\Local\Temp\Gqgistxtagnubptvmqtbtconsoleapp9.exe & RD /S /Q C:\\ProgramData\\033288724276639\\* & exit
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:900
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /pid 2388
                  8⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1184
        • C:\Users\Admin\AppData\Local\Temp\Bwxgmfnmlwaconsoleapp3.exe
          C:\Users\Admin\AppData\Local\Temp\Bwxgmfnmlwaconsoleapp3.exe
          4⤵
          • Executes dropped EXE
          PID:2772
        • C:\Users\Admin\AppData\Local\Temp\Bwxgmfnmlwaconsoleapp3.exe
          C:\Users\Admin\AppData\Local\Temp\Bwxgmfnmlwaconsoleapp3.exe
          4⤵
          • Executes dropped EXE
          PID:844
    • C:\Users\Admin\AppData\Local\Temp\e8e31ad00eb7d6e4124e0d9dcd2a2e4ca20afa68007c0e655ae8cc5ca4bfdad9.exe
      C:\Users\Admin\AppData\Local\Temp\e8e31ad00eb7d6e4124e0d9dcd2a2e4ca20afa68007c0e655ae8cc5ca4bfdad9.exe
      2⤵
        PID:3180
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\e8e31ad00eb7d6e4124e0d9dcd2a2e4ca20afa68007c0e655ae8cc5ca4bfdad9.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3536
          • C:\Windows\SysWOW64\timeout.exe
            timeout /T 10 /NOBREAK
            4⤵
            • Delays execution with timeout.exe
            PID:1796

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Bwxgmfnmlwaconsoleapp3.exe
      MD5

      4cb2b6e2c86e81a6b2ddd2aca707e66a

      SHA1

      f13428a8ea50c72c6a24bd552804ab7a11428ec1

      SHA256

      157e30e05a61154cbc5bb5e36dc43b33e500bd552f8a0624d3a02d9f1249665a

      SHA512

      156e0c11011753cf46fd4817888c56294ab001c98fc32613e70104d9fd900be874baa30ac3bf5c09e7140eaf336b06f06e85568c7c6a7de0617f06e270048ce7

    • C:\Users\Admin\AppData\Local\Temp\Bwxgmfnmlwaconsoleapp3.exe
      MD5

      4cb2b6e2c86e81a6b2ddd2aca707e66a

      SHA1

      f13428a8ea50c72c6a24bd552804ab7a11428ec1

      SHA256

      157e30e05a61154cbc5bb5e36dc43b33e500bd552f8a0624d3a02d9f1249665a

      SHA512

      156e0c11011753cf46fd4817888c56294ab001c98fc32613e70104d9fd900be874baa30ac3bf5c09e7140eaf336b06f06e85568c7c6a7de0617f06e270048ce7

    • C:\Users\Admin\AppData\Local\Temp\Bwxgmfnmlwaconsoleapp3.exe
      MD5

      4cb2b6e2c86e81a6b2ddd2aca707e66a

      SHA1

      f13428a8ea50c72c6a24bd552804ab7a11428ec1

      SHA256

      157e30e05a61154cbc5bb5e36dc43b33e500bd552f8a0624d3a02d9f1249665a

      SHA512

      156e0c11011753cf46fd4817888c56294ab001c98fc32613e70104d9fd900be874baa30ac3bf5c09e7140eaf336b06f06e85568c7c6a7de0617f06e270048ce7

    • C:\Users\Admin\AppData\Local\Temp\Bwxgmfnmlwaconsoleapp3.exe
      MD5

      4cb2b6e2c86e81a6b2ddd2aca707e66a

      SHA1

      f13428a8ea50c72c6a24bd552804ab7a11428ec1

      SHA256

      157e30e05a61154cbc5bb5e36dc43b33e500bd552f8a0624d3a02d9f1249665a

      SHA512

      156e0c11011753cf46fd4817888c56294ab001c98fc32613e70104d9fd900be874baa30ac3bf5c09e7140eaf336b06f06e85568c7c6a7de0617f06e270048ce7

    • C:\Users\Admin\AppData\Local\Temp\Eyyozukgtsxfcpfq.vbs
      MD5

      078aaa3bf115f219f01322a31f475c54

      SHA1

      e95ad53a3ad196dfb5384824d213f64056fb8155

      SHA256

      db761125f2f3e644b56284126bdb2ebeec230ddaea1540e41e61188e38a845b4

      SHA512

      98b4016beda2682652dfdef3f0b25432c1444b52064949e9ecd20d7533b76f17ebaf514b91e5bd967d20ed8025b0d8a8f6e387331806418cfef00ff3e1fd1734

    • C:\Users\Admin\AppData\Local\Temp\Gqgistxtagnubptvmqtbtconsoleapp9.exe
      MD5

      efd30cfcab12aa54745c2145a2ee763f

      SHA1

      4bfa0e547c820b576bb57fb109e6d95996e981f3

      SHA256

      1c01c74fd903447e61c5824271ab41ed22f4217ac85f3c9e2a6d0f083897bfc3

      SHA512

      57ffda0b59997a32df775cbc281a594312d4cccf22c6c86404435cace951765aeff8b702ff362078e403f7f1b3ce37b655bb96bfba84d19f06dd250ad05bcb8c

    • C:\Users\Admin\AppData\Local\Temp\Gqgistxtagnubptvmqtbtconsoleapp9.exe
      MD5

      efd30cfcab12aa54745c2145a2ee763f

      SHA1

      4bfa0e547c820b576bb57fb109e6d95996e981f3

      SHA256

      1c01c74fd903447e61c5824271ab41ed22f4217ac85f3c9e2a6d0f083897bfc3

      SHA512

      57ffda0b59997a32df775cbc281a594312d4cccf22c6c86404435cace951765aeff8b702ff362078e403f7f1b3ce37b655bb96bfba84d19f06dd250ad05bcb8c

    • C:\Users\Admin\AppData\Local\Temp\Gqgistxtagnubptvmqtbtconsoleapp9.exe
      MD5

      efd30cfcab12aa54745c2145a2ee763f

      SHA1

      4bfa0e547c820b576bb57fb109e6d95996e981f3

      SHA256

      1c01c74fd903447e61c5824271ab41ed22f4217ac85f3c9e2a6d0f083897bfc3

      SHA512

      57ffda0b59997a32df775cbc281a594312d4cccf22c6c86404435cace951765aeff8b702ff362078e403f7f1b3ce37b655bb96bfba84d19f06dd250ad05bcb8c

    • C:\Users\Admin\AppData\Local\Temp\Gqgistxtagnubptvmqtbtconsoleapp9.exe
      MD5

      efd30cfcab12aa54745c2145a2ee763f

      SHA1

      4bfa0e547c820b576bb57fb109e6d95996e981f3

      SHA256

      1c01c74fd903447e61c5824271ab41ed22f4217ac85f3c9e2a6d0f083897bfc3

      SHA512

      57ffda0b59997a32df775cbc281a594312d4cccf22c6c86404435cace951765aeff8b702ff362078e403f7f1b3ce37b655bb96bfba84d19f06dd250ad05bcb8c

    • C:\Users\Admin\AppData\Local\Temp\Nrwclnomc.vbs
      MD5

      f7b6cda2dca4391f30cf8df1f0605418

      SHA1

      656a46ae3716bf4e883b1bfb13723b92feb26b84

      SHA256

      97cb704bd02eb625b99a8cac924c826be3435912f220352bf21ccbcb9370e7ed

      SHA512

      6be78872227b0a8c328d177b0f7a7670834c7c803aa7eacc77f1ffa7c824541a895ea255b6b4777f9fd7753a4c975eaf50f4b63a51cf8c9164d56ccd86300725

    • memory/844-154-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

    • memory/844-155-0x000000000041A684-mapping.dmp
    • memory/844-165-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

    • memory/900-180-0x0000000000000000-mapping.dmp
    • memory/1184-181-0x0000000000000000-mapping.dmp
    • memory/1796-142-0x0000000000000000-mapping.dmp
    • memory/2152-128-0x0000000000000000-mapping.dmp
    • memory/2388-177-0x0000000000417A8B-mapping.dmp
    • memory/2388-179-0x0000000000400000-0x0000000000434000-memory.dmp
      Filesize

      208KB

    • memory/2388-176-0x0000000000400000-0x0000000000434000-memory.dmp
      Filesize

      208KB

    • memory/3180-133-0x0000000000400000-0x0000000000492000-memory.dmp
      Filesize

      584KB

    • memory/3180-131-0x000000000043F877-mapping.dmp
    • memory/3180-130-0x0000000000400000-0x0000000000492000-memory.dmp
      Filesize

      584KB

    • memory/3496-158-0x0000000000000000-mapping.dmp
    • memory/3496-160-0x0000000000E90000-0x0000000000E91000-memory.dmp
      Filesize

      4KB

    • memory/3496-173-0x0000000007DC0000-0x0000000007E32000-memory.dmp
      Filesize

      456KB

    • memory/3496-167-0x0000000007880000-0x00000000078D8000-memory.dmp
      Filesize

      352KB

    • memory/3496-166-0x00000000057F0000-0x0000000005CEE000-memory.dmp
      Filesize

      5.0MB

    • memory/3608-126-0x0000000008440000-0x0000000008543000-memory.dmp
      Filesize

      1.0MB

    • memory/3608-121-0x0000000007E00000-0x0000000007E01000-memory.dmp
      Filesize

      4KB

    • memory/3608-114-0x0000000000AE0000-0x0000000000AE1000-memory.dmp
      Filesize

      4KB

    • memory/3608-116-0x00000000059E0000-0x00000000059E1000-memory.dmp
      Filesize

      4KB

    • memory/3608-117-0x00000000054E0000-0x00000000054E1000-memory.dmp
      Filesize

      4KB

    • memory/3608-127-0x0000000008650000-0x0000000008651000-memory.dmp
      Filesize

      4KB

    • memory/3608-118-0x00000000055C0000-0x00000000055C1000-memory.dmp
      Filesize

      4KB

    • memory/3608-119-0x00000000054E0000-0x00000000059DE000-memory.dmp
      Filesize

      5.0MB

    • memory/3608-120-0x0000000007C50000-0x0000000007D79000-memory.dmp
      Filesize

      1.2MB

    • memory/3864-141-0x0000000005270000-0x0000000005302000-memory.dmp
      Filesize

      584KB

    • memory/3864-149-0x0000000007B20000-0x0000000007BDF000-memory.dmp
      Filesize

      764KB

    • memory/3864-143-0x0000000006F80000-0x0000000007024000-memory.dmp
      Filesize

      656KB

    • memory/3864-134-0x0000000000000000-mapping.dmp
    • memory/3864-136-0x0000000000A30000-0x0000000000A31000-memory.dmp
      Filesize

      4KB

    • memory/4012-151-0x0000000000000000-mapping.dmp