General
Target

0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe

Filesize

1MB

Completed

20-05-2022 03:59

Task

behavioral1

Score
10/10
MD5

67fb804e2e006ac7fdb5ec617f43aa35

SHA1

6b82e6290ef6d0141f26acde06fa7e2096fb46b2

SHA256

0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a

SHA256

721ea1beda72977b30cef1a929bb371e9d3808ff01a0cbb7653329f8e9aa227385dd6971409f62d9029e9372ad4e03da96635b407786c42180992c837b583a7d

Malware Config

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Extracted

Family

oski

C2

mantis.ug

Extracted

Family

raccoon

Botnet

180d3985eb74eacf2de83c771fbf30a60f670ec0

Attributes
url4cnc
https://telete.in/jrikitiki
rc4.plain
rc4.plain
Signatures 14

Filter: none

Collection
Credential Access
Discovery
  • Azorult

    Description

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Oski

    Description

    Oski is an infostealer targeting browser data, crypto wallets.

  • Raccoon

    Description

    Simple but powerful infostealer which was very active in 2019.

  • Raccoon Stealer Payload

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/1700-87-0x0000000000400000-0x0000000000493000-memory.dmpfamily_raccoon
  • Executes dropped EXE
    Pvjkdebv.exePvjadebv.exePvjkdebv.exePvjadebv.exe

    Reported IOCs

    pidprocess
    1980Pvjkdebv.exe
    1808Pvjadebv.exe
    1660Pvjkdebv.exe
    1096Pvjadebv.exe
  • Loads dropped DLL
    0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exePvjkdebv.exePvjadebv.exeWerFault.exe

    Reported IOCs

    pidprocess
    14600e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
    14600e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
    14600e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
    14600e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
    1980Pvjkdebv.exe
    1808Pvjadebv.exe
    1332WerFault.exe
    1332WerFault.exe
    1332WerFault.exe
    1332WerFault.exe
    1332WerFault.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Suspicious use of NtSetInformationThreadHideFromDebugger
    Pvjadebv.exePvjkdebv.exe0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe

    Reported IOCs

    pidprocess
    1096Pvjadebv.exe
    1096Pvjadebv.exe
    1660Pvjkdebv.exe
    1660Pvjkdebv.exe
    17000e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
    17000e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
  • Suspicious use of SetThreadContext
    Pvjkdebv.exe0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exePvjadebv.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1980 set thread context of 16601980Pvjkdebv.exePvjkdebv.exe
    PID 1460 set thread context of 170014600e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
    PID 1808 set thread context of 10961808Pvjadebv.exePvjadebv.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Program crash
    WerFault.exe

    Reported IOCs

    pidpid_targetprocesstarget process
    13321660WerFault.exePvjkdebv.exe
  • Suspicious behavior: MapViewOfSection
    Pvjkdebv.exe0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exePvjadebv.exe

    Reported IOCs

    pidprocess
    1980Pvjkdebv.exe
    14600e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
    1808Pvjadebv.exe
  • Suspicious use of SetWindowsHookEx
    0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exePvjkdebv.exePvjadebv.exe

    Reported IOCs

    pidprocess
    14600e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
    1980Pvjkdebv.exe
    1808Pvjadebv.exe
  • Suspicious use of WriteProcessMemory
    0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exePvjkdebv.exePvjadebv.exePvjkdebv.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1460 wrote to memory of 198014600e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exePvjkdebv.exe
    PID 1460 wrote to memory of 198014600e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exePvjkdebv.exe
    PID 1460 wrote to memory of 198014600e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exePvjkdebv.exe
    PID 1460 wrote to memory of 198014600e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exePvjkdebv.exe
    PID 1460 wrote to memory of 180814600e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exePvjadebv.exe
    PID 1460 wrote to memory of 180814600e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exePvjadebv.exe
    PID 1460 wrote to memory of 180814600e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exePvjadebv.exe
    PID 1460 wrote to memory of 180814600e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exePvjadebv.exe
    PID 1980 wrote to memory of 16601980Pvjkdebv.exePvjkdebv.exe
    PID 1980 wrote to memory of 16601980Pvjkdebv.exePvjkdebv.exe
    PID 1980 wrote to memory of 16601980Pvjkdebv.exePvjkdebv.exe
    PID 1980 wrote to memory of 16601980Pvjkdebv.exePvjkdebv.exe
    PID 1980 wrote to memory of 16601980Pvjkdebv.exePvjkdebv.exe
    PID 1460 wrote to memory of 170014600e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
    PID 1460 wrote to memory of 170014600e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
    PID 1460 wrote to memory of 170014600e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
    PID 1460 wrote to memory of 170014600e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
    PID 1460 wrote to memory of 170014600e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
    PID 1808 wrote to memory of 10961808Pvjadebv.exePvjadebv.exe
    PID 1808 wrote to memory of 10961808Pvjadebv.exePvjadebv.exe
    PID 1808 wrote to memory of 10961808Pvjadebv.exePvjadebv.exe
    PID 1808 wrote to memory of 10961808Pvjadebv.exePvjadebv.exe
    PID 1808 wrote to memory of 10961808Pvjadebv.exePvjadebv.exe
    PID 1660 wrote to memory of 13321660Pvjkdebv.exeWerFault.exe
    PID 1660 wrote to memory of 13321660Pvjkdebv.exeWerFault.exe
    PID 1660 wrote to memory of 13321660Pvjkdebv.exeWerFault.exe
    PID 1660 wrote to memory of 13321660Pvjkdebv.exeWerFault.exe
Processes 7
  • C:\Users\Admin\AppData\Local\Temp\0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
    "C:\Users\Admin\AppData\Local\Temp\0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe"
    Loads dropped DLL
    Suspicious use of SetThreadContext
    Suspicious behavior: MapViewOfSection
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:1460
    • C:\Users\Admin\AppData\Local\Temp\Pvjkdebv.exe
      "C:\Users\Admin\AppData\Local\Temp\Pvjkdebv.exe"
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1980
      • C:\Users\Admin\AppData\Local\Temp\Pvjkdebv.exe
        "C:\Users\Admin\AppData\Local\Temp\Pvjkdebv.exe"
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of WriteProcessMemory
        PID:1660
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 772
          Loads dropped DLL
          Program crash
          PID:1332
    • C:\Users\Admin\AppData\Local\Temp\Pvjadebv.exe
      "C:\Users\Admin\AppData\Local\Temp\Pvjadebv.exe"
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1808
      • C:\Users\Admin\AppData\Local\Temp\Pvjadebv.exe
        "C:\Users\Admin\AppData\Local\Temp\Pvjadebv.exe"
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        PID:1096
    • C:\Users\Admin\AppData\Local\Temp\0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
      "C:\Users\Admin\AppData\Local\Temp\0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe"
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1700
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Persistence
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • C:\Users\Admin\AppData\Local\Temp\Pvjadebv.exe

                      MD5

                      b782496c71766cd400caa4ea48dbc939

                      SHA1

                      4c154e3c272948621f00d526aeb3804dc8515ace

                      SHA256

                      9eb6fe1bd18fde5d7339719df4d2a86bb1aae1ef5940410f9be2dc2fdbbf61e0

                      SHA512

                      49645abf1c159f2bc012a8621f6a4b1ce6d87954753014c3ee7625e50d533b80013f90d2bcb0e20c38f6991a7bc7e315133d7a3bb1f37b9a922623e70d55c518

                    • C:\Users\Admin\AppData\Local\Temp\Pvjadebv.exe

                      MD5

                      b782496c71766cd400caa4ea48dbc939

                      SHA1

                      4c154e3c272948621f00d526aeb3804dc8515ace

                      SHA256

                      9eb6fe1bd18fde5d7339719df4d2a86bb1aae1ef5940410f9be2dc2fdbbf61e0

                      SHA512

                      49645abf1c159f2bc012a8621f6a4b1ce6d87954753014c3ee7625e50d533b80013f90d2bcb0e20c38f6991a7bc7e315133d7a3bb1f37b9a922623e70d55c518

                    • C:\Users\Admin\AppData\Local\Temp\Pvjadebv.exe

                      MD5

                      b782496c71766cd400caa4ea48dbc939

                      SHA1

                      4c154e3c272948621f00d526aeb3804dc8515ace

                      SHA256

                      9eb6fe1bd18fde5d7339719df4d2a86bb1aae1ef5940410f9be2dc2fdbbf61e0

                      SHA512

                      49645abf1c159f2bc012a8621f6a4b1ce6d87954753014c3ee7625e50d533b80013f90d2bcb0e20c38f6991a7bc7e315133d7a3bb1f37b9a922623e70d55c518

                    • C:\Users\Admin\AppData\Local\Temp\Pvjkdebv.exe

                      MD5

                      1c57b1ffb059b7cd3a7cd64f8658eef0

                      SHA1

                      e89a4d44e48ab1b80cc4386d10b7bde4467bcd4b

                      SHA256

                      7f2fb08742f42d241cdb1936fc5f18a7ee05dd53a1500c9d9ebbd30e50e75699

                      SHA512

                      ae1f0e59b3f355bdd1046721fe91a8d4bcf732baf097b5b65847b6e1ba731da910c540f84d51aed8d1286c539534c59f2368b8a32e1daa680a3d498e3aad4008

                    • C:\Users\Admin\AppData\Local\Temp\Pvjkdebv.exe

                      MD5

                      1c57b1ffb059b7cd3a7cd64f8658eef0

                      SHA1

                      e89a4d44e48ab1b80cc4386d10b7bde4467bcd4b

                      SHA256

                      7f2fb08742f42d241cdb1936fc5f18a7ee05dd53a1500c9d9ebbd30e50e75699

                      SHA512

                      ae1f0e59b3f355bdd1046721fe91a8d4bcf732baf097b5b65847b6e1ba731da910c540f84d51aed8d1286c539534c59f2368b8a32e1daa680a3d498e3aad4008

                    • C:\Users\Admin\AppData\Local\Temp\Pvjkdebv.exe

                      MD5

                      1c57b1ffb059b7cd3a7cd64f8658eef0

                      SHA1

                      e89a4d44e48ab1b80cc4386d10b7bde4467bcd4b

                      SHA256

                      7f2fb08742f42d241cdb1936fc5f18a7ee05dd53a1500c9d9ebbd30e50e75699

                      SHA512

                      ae1f0e59b3f355bdd1046721fe91a8d4bcf732baf097b5b65847b6e1ba731da910c540f84d51aed8d1286c539534c59f2368b8a32e1daa680a3d498e3aad4008

                    • \Users\Admin\AppData\Local\Temp\Pvjadebv.exe

                      MD5

                      b782496c71766cd400caa4ea48dbc939

                      SHA1

                      4c154e3c272948621f00d526aeb3804dc8515ace

                      SHA256

                      9eb6fe1bd18fde5d7339719df4d2a86bb1aae1ef5940410f9be2dc2fdbbf61e0

                      SHA512

                      49645abf1c159f2bc012a8621f6a4b1ce6d87954753014c3ee7625e50d533b80013f90d2bcb0e20c38f6991a7bc7e315133d7a3bb1f37b9a922623e70d55c518

                    • \Users\Admin\AppData\Local\Temp\Pvjadebv.exe

                      MD5

                      b782496c71766cd400caa4ea48dbc939

                      SHA1

                      4c154e3c272948621f00d526aeb3804dc8515ace

                      SHA256

                      9eb6fe1bd18fde5d7339719df4d2a86bb1aae1ef5940410f9be2dc2fdbbf61e0

                      SHA512

                      49645abf1c159f2bc012a8621f6a4b1ce6d87954753014c3ee7625e50d533b80013f90d2bcb0e20c38f6991a7bc7e315133d7a3bb1f37b9a922623e70d55c518

                    • \Users\Admin\AppData\Local\Temp\Pvjadebv.exe

                      MD5

                      b782496c71766cd400caa4ea48dbc939

                      SHA1

                      4c154e3c272948621f00d526aeb3804dc8515ace

                      SHA256

                      9eb6fe1bd18fde5d7339719df4d2a86bb1aae1ef5940410f9be2dc2fdbbf61e0

                      SHA512

                      49645abf1c159f2bc012a8621f6a4b1ce6d87954753014c3ee7625e50d533b80013f90d2bcb0e20c38f6991a7bc7e315133d7a3bb1f37b9a922623e70d55c518

                    • \Users\Admin\AppData\Local\Temp\Pvjkdebv.exe

                      MD5

                      1c57b1ffb059b7cd3a7cd64f8658eef0

                      SHA1

                      e89a4d44e48ab1b80cc4386d10b7bde4467bcd4b

                      SHA256

                      7f2fb08742f42d241cdb1936fc5f18a7ee05dd53a1500c9d9ebbd30e50e75699

                      SHA512

                      ae1f0e59b3f355bdd1046721fe91a8d4bcf732baf097b5b65847b6e1ba731da910c540f84d51aed8d1286c539534c59f2368b8a32e1daa680a3d498e3aad4008

                    • \Users\Admin\AppData\Local\Temp\Pvjkdebv.exe

                      MD5

                      1c57b1ffb059b7cd3a7cd64f8658eef0

                      SHA1

                      e89a4d44e48ab1b80cc4386d10b7bde4467bcd4b

                      SHA256

                      7f2fb08742f42d241cdb1936fc5f18a7ee05dd53a1500c9d9ebbd30e50e75699

                      SHA512

                      ae1f0e59b3f355bdd1046721fe91a8d4bcf732baf097b5b65847b6e1ba731da910c540f84d51aed8d1286c539534c59f2368b8a32e1daa680a3d498e3aad4008

                    • \Users\Admin\AppData\Local\Temp\Pvjkdebv.exe

                      MD5

                      1c57b1ffb059b7cd3a7cd64f8658eef0

                      SHA1

                      e89a4d44e48ab1b80cc4386d10b7bde4467bcd4b

                      SHA256

                      7f2fb08742f42d241cdb1936fc5f18a7ee05dd53a1500c9d9ebbd30e50e75699

                      SHA512

                      ae1f0e59b3f355bdd1046721fe91a8d4bcf732baf097b5b65847b6e1ba731da910c540f84d51aed8d1286c539534c59f2368b8a32e1daa680a3d498e3aad4008

                    • \Users\Admin\AppData\Local\Temp\Pvjkdebv.exe

                      MD5

                      1c57b1ffb059b7cd3a7cd64f8658eef0

                      SHA1

                      e89a4d44e48ab1b80cc4386d10b7bde4467bcd4b

                      SHA256

                      7f2fb08742f42d241cdb1936fc5f18a7ee05dd53a1500c9d9ebbd30e50e75699

                      SHA512

                      ae1f0e59b3f355bdd1046721fe91a8d4bcf732baf097b5b65847b6e1ba731da910c540f84d51aed8d1286c539534c59f2368b8a32e1daa680a3d498e3aad4008

                    • \Users\Admin\AppData\Local\Temp\Pvjkdebv.exe

                      MD5

                      1c57b1ffb059b7cd3a7cd64f8658eef0

                      SHA1

                      e89a4d44e48ab1b80cc4386d10b7bde4467bcd4b

                      SHA256

                      7f2fb08742f42d241cdb1936fc5f18a7ee05dd53a1500c9d9ebbd30e50e75699

                      SHA512

                      ae1f0e59b3f355bdd1046721fe91a8d4bcf732baf097b5b65847b6e1ba731da910c540f84d51aed8d1286c539534c59f2368b8a32e1daa680a3d498e3aad4008

                    • \Users\Admin\AppData\Local\Temp\Pvjkdebv.exe

                      MD5

                      1c57b1ffb059b7cd3a7cd64f8658eef0

                      SHA1

                      e89a4d44e48ab1b80cc4386d10b7bde4467bcd4b

                      SHA256

                      7f2fb08742f42d241cdb1936fc5f18a7ee05dd53a1500c9d9ebbd30e50e75699

                      SHA512

                      ae1f0e59b3f355bdd1046721fe91a8d4bcf732baf097b5b65847b6e1ba731da910c540f84d51aed8d1286c539534c59f2368b8a32e1daa680a3d498e3aad4008

                    • \Users\Admin\AppData\Local\Temp\Pvjkdebv.exe

                      MD5

                      1c57b1ffb059b7cd3a7cd64f8658eef0

                      SHA1

                      e89a4d44e48ab1b80cc4386d10b7bde4467bcd4b

                      SHA256

                      7f2fb08742f42d241cdb1936fc5f18a7ee05dd53a1500c9d9ebbd30e50e75699

                      SHA512

                      ae1f0e59b3f355bdd1046721fe91a8d4bcf732baf097b5b65847b6e1ba731da910c540f84d51aed8d1286c539534c59f2368b8a32e1daa680a3d498e3aad4008

                    • \Users\Admin\AppData\Local\Temp\Pvjkdebv.exe

                      MD5

                      1c57b1ffb059b7cd3a7cd64f8658eef0

                      SHA1

                      e89a4d44e48ab1b80cc4386d10b7bde4467bcd4b

                      SHA256

                      7f2fb08742f42d241cdb1936fc5f18a7ee05dd53a1500c9d9ebbd30e50e75699

                      SHA512

                      ae1f0e59b3f355bdd1046721fe91a8d4bcf732baf097b5b65847b6e1ba731da910c540f84d51aed8d1286c539534c59f2368b8a32e1daa680a3d498e3aad4008

                    • memory/1096-80-0x000000000041A684-mapping.dmp

                    • memory/1096-85-0x0000000000400000-0x0000000000420000-memory.dmp

                    • memory/1332-88-0x0000000000000000-mapping.dmp

                    • memory/1460-69-0x0000000002570000-0x0000000002577000-memory.dmp

                    • memory/1460-56-0x00000000769D1000-0x00000000769D3000-memory.dmp

                    • memory/1660-86-0x0000000000400000-0x0000000000434000-memory.dmp

                    • memory/1660-75-0x0000000000417A8B-mapping.dmp

                    • memory/1700-78-0x000000000043FA98-mapping.dmp

                    • memory/1700-87-0x0000000000400000-0x0000000000493000-memory.dmp

                    • memory/1808-64-0x0000000000000000-mapping.dmp

                    • memory/1980-71-0x0000000000240000-0x0000000000247000-memory.dmp

                    • memory/1980-59-0x0000000000000000-mapping.dmp