Analysis
- max time kernel
131s - max time network
120s - platform
windows7_x64 - resource
win7-en-20211014 - submitted
17/10/2021, 09:21
General
- Target 07dd2cc418847864ac674a4090105c24.exe
- Size 582KB
- Sample211017-lbb12sdchp
- SHA256 97dbb2b9d161dd2b5f26eb48acef6ef70701b75a75b2d281e3dbb7fd946de319
Score
10/10
Malware Config
Extracted
Family
-
raccoon
Botnet
-
723d14b565e8f39294f31f86b0ce56cdaee75105
Attributes
-
url4cnc
http://telegatt.top/jdiamond13
http://telegka.top/jdiamond13
http://telegin.top/jdiamond13
https://t.me/jdiamond13
rc4.plain
rc4.plain
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\07dd2cc418847864ac674a4090105c24.exe"C:\Users\Admin\AppData\Local\Temp\07dd2cc418847864ac674a4090105c24.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 4722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/516-60-0x00000000003D0000-0x00000000003D1000-memory.dmp
memory/1216-55-0x00000000002ED000-0x000000000033C000-memory.dmp
memory/1216-56-0x0000000076531000-0x0000000076533000-memory.dmp
memory/1216-57-0x0000000000840000-0x00000000008CE000-memory.dmp
memory/1216-58-0x0000000000400000-0x00000000007C3000-memory.dmp