Analysis
- max time kernel
4265061s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
16/01/2022, 00:17
General
- Target af343ce3956d9bab49c791eb72b3bed1.exe
- Size 622KB
- Sample220116-ak2saafdgm
- SHA256 e8a5ee3ea1aa198e6187b3adf18c307ce27830e827f797dd7dc1435333672c0b
Score
10/10
Malware Config
Extracted
Family
-
raccoon
Botnet
-
aabe5d462cfa56af8d12e0b06009aa8cf51ff72d
Attributes
-
url4cnc
http://5.181.156.155/benzfm1l
http://185.163.45.70/benzfm1l
http://185.163.204.22/benzfm1l
http://178.62.113.205/benzfm1l
https://t.me/benzfm1l
rc4.plain
rc4.plain
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\af343ce3956d9bab49c791eb72b3bed1.exe"C:\Users\Admin\AppData\Local\Temp\af343ce3956d9bab49c791eb72b3bed1.exe"1⤵
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/728-130-0x0000000000632000-0x0000000000683000-memory.dmp
memory/728-131-0x00000000004C0000-0x0000000000552000-memory.dmp
memory/728-132-0x0000000000400000-0x00000000004B2000-memory.dmp