Overview

overview

10

Static

static

a1d15701e7...c8.exe

windows7_x64

10

a1d15701e7...c8.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    01/01/2022, 08:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a1d15701e7d521d9a9ed1c4b37a86cc8.exe
  • Size 401KB
  • Sample220101-j7arragacj
  • SHA256 f12e6cd63a8d0c79621de6f617a1d5d58a811bc5e9a5798aa7fdb2b6fc067971
  • MD5 SHA1 SHA512
Score
10/10
raccoond6ee977d17e48189475aba8df49f69c7b76b5fa6stealer

Malware Config

Extracted

Family

  • raccoon

Botnet

  • d6ee977d17e48189475aba8df49f69c7b76b5fa6

Attributes
  • url4cnc

    http://185.163.204.21/charlyl12te

    http://178.62.127.193/charlyl12te

    http://5.181.156.155/charlyl12te

    http://185.163.45.70/charlyl12te

    http://185.163.204.22/charlyl12te

    http://178.62.113.205/charlyl12te

    https://t.me/charlyl12te

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a1d15701e7d521d9a9ed1c4b37a86cc8.exe
    "C:\Users\Admin\AppData\Local\Temp\a1d15701e7d521d9a9ed1c4b37a86cc8.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3764
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\2782736492.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1128
      • C:\Users\Admin\AppData\Local\Temp\2782736492.exe
        "C:\Users\Admin\AppData\Local\Temp\2782736492.exe"
        3⤵
        • Executes dropped EXE
        PID:1420
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 1000
          4⤵
          • Suspicious use of NtCreateProcessExOtherParentProcess
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4044

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1420-122-0x00000000009E1000-0x0000000000A32000-memory.dmp
        Download

        memory/1420-123-0x0000000000930000-0x00000000009C2000-memory.dmp
        Download

        memory/1420-124-0x0000000000400000-0x00000000007C2000-memory.dmp
        Download

        memory/3764-116-0x00000000001C0000-0x00000000001F8000-memory.dmp
        Download

        memory/3764-117-0x0000000000400000-0x0000000000791000-memory.dmp
        Download