Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-05-2022 19:17
Static task
static1
Behavioral task
behavioral1
Sample
122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe
Resource
win7-20220414-en
General
-
Target
122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe
-
Size
5.5MB
-
MD5
d2c47c3ee0a9e1bec99cba90f39fb843
-
SHA1
4f1c9b979e2de7270b6da85b75c7e37eb3c78648
-
SHA256
122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37
-
SHA512
494e2722de57ff7ff6cfceb4377cc86640941945c1ad644ccfcb78bcfdd0ce37b5b9f49eb477f605ab8fee8b483b657993211aa6dfa844fa144f2ba1fde5d3ef
Malware Config
Extracted
raccoon
c763e433ef51ff4b6c545800e4ba3b3b1a2ea077
-
url4cnc
https://telete.in/jbitchsucks
Signatures
-
Raccoon Stealer Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4596-139-0x0000000000400000-0x0000000000493000-memory.dmp family_raccoon behavioral2/memory/4596-140-0x0000000000400000-0x0000000000493000-memory.dmp family_raccoon behavioral2/memory/4596-141-0x0000000000400000-0x0000000000493000-memory.dmp family_raccoon behavioral2/memory/4596-142-0x0000000000400000-0x0000000000493000-memory.dmp family_raccoon -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe -
Processes:
resource yara_rule behavioral2/memory/4788-132-0x0000000000F80000-0x0000000001560000-memory.dmp themida behavioral2/memory/4788-133-0x0000000000F80000-0x0000000001560000-memory.dmp themida -
Processes:
122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exedescription pid process target process PID 4788 set thread context of 4596 4788 122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe 122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exedescription pid process Token: SeDebugPrivilege 4788 122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exedescription pid process target process PID 4788 wrote to memory of 4596 4788 122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe 122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe PID 4788 wrote to memory of 4596 4788 122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe 122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe PID 4788 wrote to memory of 4596 4788 122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe 122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe PID 4788 wrote to memory of 4596 4788 122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe 122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe PID 4788 wrote to memory of 4596 4788 122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe 122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe PID 4788 wrote to memory of 4596 4788 122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe 122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe PID 4788 wrote to memory of 4596 4788 122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe 122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe PID 4788 wrote to memory of 4596 4788 122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe 122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe PID 4788 wrote to memory of 4596 4788 122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe 122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe"C:\Users\Admin\AppData\Local\Temp\122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe"C:\Users\Admin\AppData\Local\Temp\122562ead436824cf33e2dad217a6bb0852eff2338e9f7753fa9a0c361020c37.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4596-138-0x0000000000000000-mapping.dmp
-
memory/4596-139-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/4596-140-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/4596-141-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/4596-142-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/4788-132-0x0000000000F80000-0x0000000001560000-memory.dmpFilesize
5.9MB
-
memory/4788-133-0x0000000000F80000-0x0000000001560000-memory.dmpFilesize
5.9MB
-
memory/4788-134-0x0000000005690000-0x000000000572C000-memory.dmpFilesize
624KB
-
memory/4788-135-0x00000000082A0000-0x0000000008844000-memory.dmpFilesize
5.6MB
-
memory/4788-136-0x0000000007DD0000-0x0000000007E62000-memory.dmpFilesize
584KB
-
memory/4788-137-0x0000000005030000-0x0000000005052000-memory.dmpFilesize
136KB