Analysis
- max time kernel
158s - max time network
166s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
22/03/2022, 19:02
General
- Target 3d5dd911a0345dec809782512d23dda3.exe
- Size 524KB
- Sample220322-xpsfqsghb4
- SHA256 5551acf69e2dfecdfaaf1d327d308bda79cdd40864a8d4ecfd6d47bfa6f0f68a
Malware Config
Extracted
-
raccoon
-
047eaa1340214d99a8deec47621412aa3ca866db
-
url4cnc
http://185.163.204.81/ogaollebro1
http://194.180.191.33/ogaollebro1
http://174.138.11.98/ogaollebro1
http://194.180.191.44/ogaollebro1
http://91.219.236.120/ogaollebro1
https://t.me/ogaollebro1
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- Modifies data under HKEY_USERS 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d5dd911a0345dec809782512d23dda3.exe"C:\Users\Admin\AppData\Local\Temp\3d5dd911a0345dec809782512d23dda3.exe"1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1396-140-0x0000000000400000-0x00000000004B4000-memory.dmp
memory/1396-137-0x000000000069C000-0x00000000006ED000-memory.dmp
memory/1396-138-0x000000000069C000-0x00000000006ED000-memory.dmp
memory/1396-139-0x0000000002190000-0x0000000002222000-memory.dmp
memory/3124-135-0x0000022772060000-0x0000022772070000-memory.dmp
memory/3124-136-0x0000022774600000-0x0000022774604000-memory.dmp
memory/3124-134-0x0000022771780000-0x0000022771790000-memory.dmp
memory/3124-141-0x00000227748D0000-0x00000227748D4000-memory.dmp
memory/3124-142-0x00000227748B0000-0x00000227748B1000-memory.dmp
memory/3124-143-0x0000022774630000-0x0000022774634000-memory.dmp
memory/3124-144-0x0000022774620000-0x0000022774621000-memory.dmp
memory/3124-145-0x0000022774620000-0x0000022774624000-memory.dmp
memory/3124-146-0x0000022772320000-0x0000022772321000-memory.dmp