Analysis
-
max time kernel
149s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
16-05-2022 05:12
Static task
static1
Behavioral task
behavioral1
Sample
f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe
Resource
win10v2004-20220414-en
General
-
Target
f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe
-
Size
1.0MB
-
MD5
2292f50e6ebdf3eae9cbb254ca0464a9
-
SHA1
5e7897406f6a5859638982f347d569bc2bfe3614
-
SHA256
f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2
-
SHA512
688c8814bef5f31254a66a4d83d08d0e2d81ee00eee7887829f3c8639c75cae323e1f30d9bb07ee1751c4c4d06d7ea6315ba48509613c5364ea930c6485586a5
Malware Config
Extracted
raccoon
236c7f8a01d741b888dc6b6209805e66d41e62ba
-
url4cnc
https://telete.in/brikitiki
Extracted
oski
nadia.ac.ug
Extracted
azorult
http://195.245.112.115/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Raccoon Stealer Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1164-76-0x0000000000400000-0x0000000000493000-memory.dmp family_raccoon -
Executes dropped EXE 4 IoCs
Processes:
VjghertvcSD.exeIhfgetrDSqwe.exeIhfgetrDSqwe.exeVjghertvcSD.exepid process 784 VjghertvcSD.exe 1544 IhfgetrDSqwe.exe 1248 IhfgetrDSqwe.exe 1792 VjghertvcSD.exe -
Loads dropped DLL 11 IoCs
Processes:
f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exeIhfgetrDSqwe.exeVjghertvcSD.exeWerFault.exepid process 1664 f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe 1664 f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe 1664 f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe 1664 f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe 1544 IhfgetrDSqwe.exe 784 VjghertvcSD.exe 1692 WerFault.exe 1692 WerFault.exe 1692 WerFault.exe 1692 WerFault.exe 1692 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
IhfgetrDSqwe.exeVjghertvcSD.exepid process 1248 IhfgetrDSqwe.exe 1248 IhfgetrDSqwe.exe 1792 VjghertvcSD.exe 1792 VjghertvcSD.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exeIhfgetrDSqwe.exeVjghertvcSD.exedescription pid process target process PID 1664 set thread context of 1164 1664 f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe PID 1544 set thread context of 1248 1544 IhfgetrDSqwe.exe IhfgetrDSqwe.exe PID 784 set thread context of 1792 784 VjghertvcSD.exe VjghertvcSD.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1692 1248 WerFault.exe IhfgetrDSqwe.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exeIhfgetrDSqwe.exeVjghertvcSD.exepid process 1664 f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe 1544 IhfgetrDSqwe.exe 784 VjghertvcSD.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exeVjghertvcSD.exeIhfgetrDSqwe.exepid process 1664 f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe 784 VjghertvcSD.exe 1544 IhfgetrDSqwe.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exeIhfgetrDSqwe.exeVjghertvcSD.exeIhfgetrDSqwe.exedescription pid process target process PID 1664 wrote to memory of 784 1664 f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe VjghertvcSD.exe PID 1664 wrote to memory of 784 1664 f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe VjghertvcSD.exe PID 1664 wrote to memory of 784 1664 f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe VjghertvcSD.exe PID 1664 wrote to memory of 784 1664 f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe VjghertvcSD.exe PID 1664 wrote to memory of 1544 1664 f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe IhfgetrDSqwe.exe PID 1664 wrote to memory of 1544 1664 f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe IhfgetrDSqwe.exe PID 1664 wrote to memory of 1544 1664 f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe IhfgetrDSqwe.exe PID 1664 wrote to memory of 1544 1664 f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe IhfgetrDSqwe.exe PID 1664 wrote to memory of 1164 1664 f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe PID 1664 wrote to memory of 1164 1664 f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe PID 1664 wrote to memory of 1164 1664 f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe PID 1664 wrote to memory of 1164 1664 f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe PID 1664 wrote to memory of 1164 1664 f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe PID 1544 wrote to memory of 1248 1544 IhfgetrDSqwe.exe IhfgetrDSqwe.exe PID 1544 wrote to memory of 1248 1544 IhfgetrDSqwe.exe IhfgetrDSqwe.exe PID 1544 wrote to memory of 1248 1544 IhfgetrDSqwe.exe IhfgetrDSqwe.exe PID 1544 wrote to memory of 1248 1544 IhfgetrDSqwe.exe IhfgetrDSqwe.exe PID 1544 wrote to memory of 1248 1544 IhfgetrDSqwe.exe IhfgetrDSqwe.exe PID 784 wrote to memory of 1792 784 VjghertvcSD.exe VjghertvcSD.exe PID 784 wrote to memory of 1792 784 VjghertvcSD.exe VjghertvcSD.exe PID 784 wrote to memory of 1792 784 VjghertvcSD.exe VjghertvcSD.exe PID 784 wrote to memory of 1792 784 VjghertvcSD.exe VjghertvcSD.exe PID 784 wrote to memory of 1792 784 VjghertvcSD.exe VjghertvcSD.exe PID 1248 wrote to memory of 1692 1248 IhfgetrDSqwe.exe WerFault.exe PID 1248 wrote to memory of 1692 1248 IhfgetrDSqwe.exe WerFault.exe PID 1248 wrote to memory of 1692 1248 IhfgetrDSqwe.exe WerFault.exe PID 1248 wrote to memory of 1692 1248 IhfgetrDSqwe.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe"C:\Users\Admin\AppData\Local\Temp\f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VjghertvcSD.exe"C:\Users\Admin\AppData\Local\Temp\VjghertvcSD.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VjghertvcSD.exe"C:\Users\Admin\AppData\Local\Temp\VjghertvcSD.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exe"C:\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exe"C:\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 7444⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe"C:\Users\Admin\AppData\Local\Temp\f539c1e201030689ba917991a929526485f79e99f421802a9a7dc4d9a962ecd2.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exeFilesize
244KB
MD5e22eec453d5d077fecdc1fe9ead85a16
SHA1fdca78352ec06d5b695db0ad3b8c4acb8ba965ba
SHA256a52ed8a9f6d0d26517e6c0940c46345235f226634031fb5ab285f5c1a5d5d7b1
SHA51224e0ff9e37fce0bd0d89215819ae6b44646193a27f424a7475d0d9922902dedc767fb558ffa3a045a2d444665fedbeea86cb821de8415bcb4cfdecd6e4ef140f
-
C:\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exeFilesize
244KB
MD5e22eec453d5d077fecdc1fe9ead85a16
SHA1fdca78352ec06d5b695db0ad3b8c4acb8ba965ba
SHA256a52ed8a9f6d0d26517e6c0940c46345235f226634031fb5ab285f5c1a5d5d7b1
SHA51224e0ff9e37fce0bd0d89215819ae6b44646193a27f424a7475d0d9922902dedc767fb558ffa3a045a2d444665fedbeea86cb821de8415bcb4cfdecd6e4ef140f
-
C:\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exeFilesize
244KB
MD5e22eec453d5d077fecdc1fe9ead85a16
SHA1fdca78352ec06d5b695db0ad3b8c4acb8ba965ba
SHA256a52ed8a9f6d0d26517e6c0940c46345235f226634031fb5ab285f5c1a5d5d7b1
SHA51224e0ff9e37fce0bd0d89215819ae6b44646193a27f424a7475d0d9922902dedc767fb558ffa3a045a2d444665fedbeea86cb821de8415bcb4cfdecd6e4ef140f
-
C:\Users\Admin\AppData\Local\Temp\VjghertvcSD.exeFilesize
200KB
MD5ce9ef402a6bb862ee9320dbdff92724c
SHA15a5f67412735e2be4f21d184ab6cc2c427eba389
SHA2567c95dcd99bc8274293fc772afe6ad67ba2dccadb671dad68ee9fe5898ff25ea6
SHA5128d38528418d2f260f5699456bc0525dbefe047be233ac5b3a735836f0810227821acf05a78200fd48592117906acc04e9c30d66f3d51be87e91512bcbffd0048
-
C:\Users\Admin\AppData\Local\Temp\VjghertvcSD.exeFilesize
200KB
MD5ce9ef402a6bb862ee9320dbdff92724c
SHA15a5f67412735e2be4f21d184ab6cc2c427eba389
SHA2567c95dcd99bc8274293fc772afe6ad67ba2dccadb671dad68ee9fe5898ff25ea6
SHA5128d38528418d2f260f5699456bc0525dbefe047be233ac5b3a735836f0810227821acf05a78200fd48592117906acc04e9c30d66f3d51be87e91512bcbffd0048
-
C:\Users\Admin\AppData\Local\Temp\VjghertvcSD.exeFilesize
200KB
MD5ce9ef402a6bb862ee9320dbdff92724c
SHA15a5f67412735e2be4f21d184ab6cc2c427eba389
SHA2567c95dcd99bc8274293fc772afe6ad67ba2dccadb671dad68ee9fe5898ff25ea6
SHA5128d38528418d2f260f5699456bc0525dbefe047be233ac5b3a735836f0810227821acf05a78200fd48592117906acc04e9c30d66f3d51be87e91512bcbffd0048
-
\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exeFilesize
244KB
MD5e22eec453d5d077fecdc1fe9ead85a16
SHA1fdca78352ec06d5b695db0ad3b8c4acb8ba965ba
SHA256a52ed8a9f6d0d26517e6c0940c46345235f226634031fb5ab285f5c1a5d5d7b1
SHA51224e0ff9e37fce0bd0d89215819ae6b44646193a27f424a7475d0d9922902dedc767fb558ffa3a045a2d444665fedbeea86cb821de8415bcb4cfdecd6e4ef140f
-
\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exeFilesize
244KB
MD5e22eec453d5d077fecdc1fe9ead85a16
SHA1fdca78352ec06d5b695db0ad3b8c4acb8ba965ba
SHA256a52ed8a9f6d0d26517e6c0940c46345235f226634031fb5ab285f5c1a5d5d7b1
SHA51224e0ff9e37fce0bd0d89215819ae6b44646193a27f424a7475d0d9922902dedc767fb558ffa3a045a2d444665fedbeea86cb821de8415bcb4cfdecd6e4ef140f
-
\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exeFilesize
244KB
MD5e22eec453d5d077fecdc1fe9ead85a16
SHA1fdca78352ec06d5b695db0ad3b8c4acb8ba965ba
SHA256a52ed8a9f6d0d26517e6c0940c46345235f226634031fb5ab285f5c1a5d5d7b1
SHA51224e0ff9e37fce0bd0d89215819ae6b44646193a27f424a7475d0d9922902dedc767fb558ffa3a045a2d444665fedbeea86cb821de8415bcb4cfdecd6e4ef140f
-
\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exeFilesize
244KB
MD5e22eec453d5d077fecdc1fe9ead85a16
SHA1fdca78352ec06d5b695db0ad3b8c4acb8ba965ba
SHA256a52ed8a9f6d0d26517e6c0940c46345235f226634031fb5ab285f5c1a5d5d7b1
SHA51224e0ff9e37fce0bd0d89215819ae6b44646193a27f424a7475d0d9922902dedc767fb558ffa3a045a2d444665fedbeea86cb821de8415bcb4cfdecd6e4ef140f
-
\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exeFilesize
244KB
MD5e22eec453d5d077fecdc1fe9ead85a16
SHA1fdca78352ec06d5b695db0ad3b8c4acb8ba965ba
SHA256a52ed8a9f6d0d26517e6c0940c46345235f226634031fb5ab285f5c1a5d5d7b1
SHA51224e0ff9e37fce0bd0d89215819ae6b44646193a27f424a7475d0d9922902dedc767fb558ffa3a045a2d444665fedbeea86cb821de8415bcb4cfdecd6e4ef140f
-
\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exeFilesize
244KB
MD5e22eec453d5d077fecdc1fe9ead85a16
SHA1fdca78352ec06d5b695db0ad3b8c4acb8ba965ba
SHA256a52ed8a9f6d0d26517e6c0940c46345235f226634031fb5ab285f5c1a5d5d7b1
SHA51224e0ff9e37fce0bd0d89215819ae6b44646193a27f424a7475d0d9922902dedc767fb558ffa3a045a2d444665fedbeea86cb821de8415bcb4cfdecd6e4ef140f
-
\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exeFilesize
244KB
MD5e22eec453d5d077fecdc1fe9ead85a16
SHA1fdca78352ec06d5b695db0ad3b8c4acb8ba965ba
SHA256a52ed8a9f6d0d26517e6c0940c46345235f226634031fb5ab285f5c1a5d5d7b1
SHA51224e0ff9e37fce0bd0d89215819ae6b44646193a27f424a7475d0d9922902dedc767fb558ffa3a045a2d444665fedbeea86cb821de8415bcb4cfdecd6e4ef140f
-
\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exeFilesize
244KB
MD5e22eec453d5d077fecdc1fe9ead85a16
SHA1fdca78352ec06d5b695db0ad3b8c4acb8ba965ba
SHA256a52ed8a9f6d0d26517e6c0940c46345235f226634031fb5ab285f5c1a5d5d7b1
SHA51224e0ff9e37fce0bd0d89215819ae6b44646193a27f424a7475d0d9922902dedc767fb558ffa3a045a2d444665fedbeea86cb821de8415bcb4cfdecd6e4ef140f
-
\Users\Admin\AppData\Local\Temp\VjghertvcSD.exeFilesize
200KB
MD5ce9ef402a6bb862ee9320dbdff92724c
SHA15a5f67412735e2be4f21d184ab6cc2c427eba389
SHA2567c95dcd99bc8274293fc772afe6ad67ba2dccadb671dad68ee9fe5898ff25ea6
SHA5128d38528418d2f260f5699456bc0525dbefe047be233ac5b3a735836f0810227821acf05a78200fd48592117906acc04e9c30d66f3d51be87e91512bcbffd0048
-
\Users\Admin\AppData\Local\Temp\VjghertvcSD.exeFilesize
200KB
MD5ce9ef402a6bb862ee9320dbdff92724c
SHA15a5f67412735e2be4f21d184ab6cc2c427eba389
SHA2567c95dcd99bc8274293fc772afe6ad67ba2dccadb671dad68ee9fe5898ff25ea6
SHA5128d38528418d2f260f5699456bc0525dbefe047be233ac5b3a735836f0810227821acf05a78200fd48592117906acc04e9c30d66f3d51be87e91512bcbffd0048
-
\Users\Admin\AppData\Local\Temp\VjghertvcSD.exeFilesize
200KB
MD5ce9ef402a6bb862ee9320dbdff92724c
SHA15a5f67412735e2be4f21d184ab6cc2c427eba389
SHA2567c95dcd99bc8274293fc772afe6ad67ba2dccadb671dad68ee9fe5898ff25ea6
SHA5128d38528418d2f260f5699456bc0525dbefe047be233ac5b3a735836f0810227821acf05a78200fd48592117906acc04e9c30d66f3d51be87e91512bcbffd0048
-
memory/784-59-0x0000000000000000-mapping.dmp
-
memory/784-73-0x0000000000260000-0x0000000000268000-memory.dmpFilesize
32KB
-
memory/1164-71-0x000000000043FA93-mapping.dmp
-
memory/1164-76-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/1248-87-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1248-79-0x0000000000417A8B-mapping.dmp
-
memory/1544-75-0x00000000003D0000-0x00000000003D8000-memory.dmpFilesize
32KB
-
memory/1544-66-0x0000000000000000-mapping.dmp
-
memory/1664-74-0x00000000003D0000-0x00000000003D7000-memory.dmpFilesize
28KB
-
memory/1664-56-0x0000000075AE1000-0x0000000075AE3000-memory.dmpFilesize
8KB
-
memory/1692-89-0x0000000000000000-mapping.dmp
-
memory/1792-88-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1792-84-0x000000000041A684-mapping.dmp