Analysis
-
max time kernel
55s -
max time network
70s -
platform
windows10_x64 -
resource
win10-20220223-en -
submitted
13-03-2022 21:15
Static task
static1
Behavioral task
behavioral1
Sample
30f8d690fcd9bc1e0020f6b3a916ad71e5b2df3cdb17e02e5a1565b579bf7319.exe
Resource
win10-20220223-en
General
-
Target
30f8d690fcd9bc1e0020f6b3a916ad71e5b2df3cdb17e02e5a1565b579bf7319.exe
-
Size
518KB
-
MD5
066dd2538407a6ae20996556d4f67d50
-
SHA1
5586f384bb7441a529b4d4d24bb2f50578bf7f2a
-
SHA256
30f8d690fcd9bc1e0020f6b3a916ad71e5b2df3cdb17e02e5a1565b579bf7319
-
SHA512
a0500413cca66e65b5bd37a5ac444223dae2139df43c7797ec259e83825fb5b3041b32d88f460ba5092f9068b95cbf0c49200b6f60103be0ed4a09abb4f85a89
Malware Config
Extracted
raccoon
ccba3157b9f42051adf38fbb8f5d0aca7f2b7366
-
url4cnc
http://185.163.204.81/nui8xtgen
http://194.180.191.33/nui8xtgen
http://174.138.11.98/nui8xtgen
http://194.180.191.44/nui8xtgen
http://91.219.236.120/nui8xtgen
https://t.me/nui8xtgen
Signatures
-
suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)
suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)
-
suricata: ET MALWARE Win32.Raccoon Stealer Checkin M6
suricata: ET MALWARE Win32.Raccoon Stealer Checkin M6
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3820 2440 WerFault.exe 30f8d690fcd9bc1e0020f6b3a916ad71e5b2df3cdb17e02e5a1565b579bf7319.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\30f8d690fcd9bc1e0020f6b3a916ad71e5b2df3cdb17e02e5a1565b579bf7319.exe"C:\Users\Admin\AppData\Local\Temp\30f8d690fcd9bc1e0020f6b3a916ad71e5b2df3cdb17e02e5a1565b579bf7319.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 8762⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2440-114-0x000000000071D000-0x000000000076D000-memory.dmpFilesize
320KB
-
memory/2440-115-0x00000000005F0000-0x000000000073A000-memory.dmpFilesize
1.3MB
-
memory/2440-116-0x0000000002240000-0x00000000022D2000-memory.dmpFilesize
584KB
-
memory/2440-117-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB