Analysis
- max time kernel
144s - max time network
153s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
08/12/2021, 02:56
General
- Target b5c9ff926c9f4a9aeb8db3456a2265ea.exe
- Size 409KB
- Sample211208-de2f4shfd6
- SHA256 7eb4f7f0ebf9c5e63154e8866f3f7591eb52c132e6d4c62b55ebe2c492f541cc
Score
10/10
Malware Config
Extracted
Family
-
raccoon
Version
-
1.8.3-hotfix
Botnet
-
fd4f23250443a724a3d1548e6ab07c481dfc2814
Attributes
-
url4cnc
http://91.219.236.27/duglassa1
http://94.158.245.167/duglassa1
http://185.163.204.216/duglassa1
http://185.225.19.238/duglassa1
http://185.163.204.218/duglassa1
https://t.me/duglassa1
rc4.plain
rc4.plain
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5c9ff926c9f4a9aeb8db3456a2265ea.exe"C:\Users\Admin\AppData\Local\Temp\b5c9ff926c9f4a9aeb8db3456a2265ea.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\2195319743.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2195319743.exe"C:\Users\Admin\AppData\Local\Temp\2195319743.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2036-123-0x0000000004850000-0x00000000048DF000-memory.dmp
memory/2036-122-0x0000000002C10000-0x0000000002C5F000-memory.dmp
memory/2036-124-0x0000000000400000-0x0000000002BBD000-memory.dmp
memory/3388-116-0x00000000021B0000-0x00000000021FA000-memory.dmp
memory/3388-117-0x0000000000400000-0x000000000046C000-memory.dmp