Analysis
-
max time kernel
129s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
09-11-2021 10:37
Static task
static1
Behavioral task
behavioral1
Sample
b3fe60a32c6274acd39f189c93c2e0bd.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
b3fe60a32c6274acd39f189c93c2e0bd.exe
Resource
win10-en-20211014
General
-
Target
b3fe60a32c6274acd39f189c93c2e0bd.exe
-
Size
503KB
-
MD5
b3fe60a32c6274acd39f189c93c2e0bd
-
SHA1
3b18e8c5c79b404ad7553be9e30270396bc69de5
-
SHA256
e04f6d6b73cbeb3b5ed8834cd2c8a386daeab02e94937b54f6579802c2433e31
-
SHA512
b6acc24b4fa2665a37a6cc75b8e38a949c4364ae121d20980df33faeb9b128f3cdef709d81c25d09ba72e3aeab0a4a72c503fa20411ff8e8ad5cc25ca0125893
Malware Config
Extracted
raccoon
1.8.3-hotfix
fcdc156d3872c18d25e3ee45499599b45e492a67
-
url4cnc
http://178.23.190.57/rino115sipsip
http://91.219.236.162/rino115sipsip
http://185.163.47.176/rino115sipsip
http://193.38.54.238/rino115sipsip
http://74.119.192.122/rino115sipsip
http://91.219.236.240/rino115sipsip
https://t.me/rino115sipsip
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1112 652 WerFault.exe b3fe60a32c6274acd39f189c93c2e0bd.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
WerFault.exepid process 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 1112 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 1112 WerFault.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
b3fe60a32c6274acd39f189c93c2e0bd.exedescription pid process target process PID 652 wrote to memory of 1112 652 b3fe60a32c6274acd39f189c93c2e0bd.exe WerFault.exe PID 652 wrote to memory of 1112 652 b3fe60a32c6274acd39f189c93c2e0bd.exe WerFault.exe PID 652 wrote to memory of 1112 652 b3fe60a32c6274acd39f189c93c2e0bd.exe WerFault.exe PID 652 wrote to memory of 1112 652 b3fe60a32c6274acd39f189c93c2e0bd.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3fe60a32c6274acd39f189c93c2e0bd.exe"C:\Users\Admin\AppData\Local\Temp\b3fe60a32c6274acd39f189c93c2e0bd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 4442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/652-55-0x0000000075A61000-0x0000000075A63000-memory.dmpFilesize
8KB
-
memory/652-56-0x0000000000220000-0x000000000026F000-memory.dmpFilesize
316KB
-
memory/652-57-0x0000000000330000-0x00000000003BF000-memory.dmpFilesize
572KB
-
memory/652-58-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/1112-59-0x0000000000000000-mapping.dmp
-
memory/1112-60-0x00000000007D0000-0x00000000007D1000-memory.dmpFilesize
4KB