Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    20-05-2022 03:41

General

  • Target

    0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe

  • Size

    1.1MB

  • MD5

    67fb804e2e006ac7fdb5ec617f43aa35

  • SHA1

    6b82e6290ef6d0141f26acde06fa7e2096fb46b2

  • SHA256

    0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a

  • SHA512

    721ea1beda72977b30cef1a929bb371e9d3808ff01a0cbb7653329f8e9aa227385dd6971409f62d9029e9372ad4e03da96635b407786c42180992c837b583a7d

Malware Config

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Extracted

Family

oski

C2

mantis.ug

Extracted

Family

raccoon

Botnet

180d3985eb74eacf2de83c771fbf30a60f670ec0

Attributes
  • url4cnc

    https://telete.in/jrikitiki

rc4.plain
rc4.plain

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Raccoon Stealer Payload 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
    "C:\Users\Admin\AppData\Local\Temp\0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1460
    • C:\Users\Admin\AppData\Local\Temp\Pvjkdebv.exe
      "C:\Users\Admin\AppData\Local\Temp\Pvjkdebv.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1980
      • C:\Users\Admin\AppData\Local\Temp\Pvjkdebv.exe
        "C:\Users\Admin\AppData\Local\Temp\Pvjkdebv.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of WriteProcessMemory
        PID:1660
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 772
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:1332
    • C:\Users\Admin\AppData\Local\Temp\Pvjadebv.exe
      "C:\Users\Admin\AppData\Local\Temp\Pvjadebv.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1808
      • C:\Users\Admin\AppData\Local\Temp\Pvjadebv.exe
        "C:\Users\Admin\AppData\Local\Temp\Pvjadebv.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        PID:1096
    • C:\Users\Admin\AppData\Local\Temp\0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe
      "C:\Users\Admin\AppData\Local\Temp\0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1700

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Pvjadebv.exe
    Filesize

    228KB

    MD5

    b782496c71766cd400caa4ea48dbc939

    SHA1

    4c154e3c272948621f00d526aeb3804dc8515ace

    SHA256

    9eb6fe1bd18fde5d7339719df4d2a86bb1aae1ef5940410f9be2dc2fdbbf61e0

    SHA512

    49645abf1c159f2bc012a8621f6a4b1ce6d87954753014c3ee7625e50d533b80013f90d2bcb0e20c38f6991a7bc7e315133d7a3bb1f37b9a922623e70d55c518

  • C:\Users\Admin\AppData\Local\Temp\Pvjadebv.exe
    Filesize

    228KB

    MD5

    b782496c71766cd400caa4ea48dbc939

    SHA1

    4c154e3c272948621f00d526aeb3804dc8515ace

    SHA256

    9eb6fe1bd18fde5d7339719df4d2a86bb1aae1ef5940410f9be2dc2fdbbf61e0

    SHA512

    49645abf1c159f2bc012a8621f6a4b1ce6d87954753014c3ee7625e50d533b80013f90d2bcb0e20c38f6991a7bc7e315133d7a3bb1f37b9a922623e70d55c518

  • C:\Users\Admin\AppData\Local\Temp\Pvjadebv.exe
    Filesize

    228KB

    MD5

    b782496c71766cd400caa4ea48dbc939

    SHA1

    4c154e3c272948621f00d526aeb3804dc8515ace

    SHA256

    9eb6fe1bd18fde5d7339719df4d2a86bb1aae1ef5940410f9be2dc2fdbbf61e0

    SHA512

    49645abf1c159f2bc012a8621f6a4b1ce6d87954753014c3ee7625e50d533b80013f90d2bcb0e20c38f6991a7bc7e315133d7a3bb1f37b9a922623e70d55c518

  • C:\Users\Admin\AppData\Local\Temp\Pvjkdebv.exe
    Filesize

    272KB

    MD5

    1c57b1ffb059b7cd3a7cd64f8658eef0

    SHA1

    e89a4d44e48ab1b80cc4386d10b7bde4467bcd4b

    SHA256

    7f2fb08742f42d241cdb1936fc5f18a7ee05dd53a1500c9d9ebbd30e50e75699

    SHA512

    ae1f0e59b3f355bdd1046721fe91a8d4bcf732baf097b5b65847b6e1ba731da910c540f84d51aed8d1286c539534c59f2368b8a32e1daa680a3d498e3aad4008

  • C:\Users\Admin\AppData\Local\Temp\Pvjkdebv.exe
    Filesize

    272KB

    MD5

    1c57b1ffb059b7cd3a7cd64f8658eef0

    SHA1

    e89a4d44e48ab1b80cc4386d10b7bde4467bcd4b

    SHA256

    7f2fb08742f42d241cdb1936fc5f18a7ee05dd53a1500c9d9ebbd30e50e75699

    SHA512

    ae1f0e59b3f355bdd1046721fe91a8d4bcf732baf097b5b65847b6e1ba731da910c540f84d51aed8d1286c539534c59f2368b8a32e1daa680a3d498e3aad4008

  • C:\Users\Admin\AppData\Local\Temp\Pvjkdebv.exe
    Filesize

    272KB

    MD5

    1c57b1ffb059b7cd3a7cd64f8658eef0

    SHA1

    e89a4d44e48ab1b80cc4386d10b7bde4467bcd4b

    SHA256

    7f2fb08742f42d241cdb1936fc5f18a7ee05dd53a1500c9d9ebbd30e50e75699

    SHA512

    ae1f0e59b3f355bdd1046721fe91a8d4bcf732baf097b5b65847b6e1ba731da910c540f84d51aed8d1286c539534c59f2368b8a32e1daa680a3d498e3aad4008

  • \Users\Admin\AppData\Local\Temp\Pvjadebv.exe
    Filesize

    228KB

    MD5

    b782496c71766cd400caa4ea48dbc939

    SHA1

    4c154e3c272948621f00d526aeb3804dc8515ace

    SHA256

    9eb6fe1bd18fde5d7339719df4d2a86bb1aae1ef5940410f9be2dc2fdbbf61e0

    SHA512

    49645abf1c159f2bc012a8621f6a4b1ce6d87954753014c3ee7625e50d533b80013f90d2bcb0e20c38f6991a7bc7e315133d7a3bb1f37b9a922623e70d55c518

  • \Users\Admin\AppData\Local\Temp\Pvjadebv.exe
    Filesize

    228KB

    MD5

    b782496c71766cd400caa4ea48dbc939

    SHA1

    4c154e3c272948621f00d526aeb3804dc8515ace

    SHA256

    9eb6fe1bd18fde5d7339719df4d2a86bb1aae1ef5940410f9be2dc2fdbbf61e0

    SHA512

    49645abf1c159f2bc012a8621f6a4b1ce6d87954753014c3ee7625e50d533b80013f90d2bcb0e20c38f6991a7bc7e315133d7a3bb1f37b9a922623e70d55c518

  • \Users\Admin\AppData\Local\Temp\Pvjadebv.exe
    Filesize

    228KB

    MD5

    b782496c71766cd400caa4ea48dbc939

    SHA1

    4c154e3c272948621f00d526aeb3804dc8515ace

    SHA256

    9eb6fe1bd18fde5d7339719df4d2a86bb1aae1ef5940410f9be2dc2fdbbf61e0

    SHA512

    49645abf1c159f2bc012a8621f6a4b1ce6d87954753014c3ee7625e50d533b80013f90d2bcb0e20c38f6991a7bc7e315133d7a3bb1f37b9a922623e70d55c518

  • \Users\Admin\AppData\Local\Temp\Pvjkdebv.exe
    Filesize

    272KB

    MD5

    1c57b1ffb059b7cd3a7cd64f8658eef0

    SHA1

    e89a4d44e48ab1b80cc4386d10b7bde4467bcd4b

    SHA256

    7f2fb08742f42d241cdb1936fc5f18a7ee05dd53a1500c9d9ebbd30e50e75699

    SHA512

    ae1f0e59b3f355bdd1046721fe91a8d4bcf732baf097b5b65847b6e1ba731da910c540f84d51aed8d1286c539534c59f2368b8a32e1daa680a3d498e3aad4008

  • \Users\Admin\AppData\Local\Temp\Pvjkdebv.exe
    Filesize

    272KB

    MD5

    1c57b1ffb059b7cd3a7cd64f8658eef0

    SHA1

    e89a4d44e48ab1b80cc4386d10b7bde4467bcd4b

    SHA256

    7f2fb08742f42d241cdb1936fc5f18a7ee05dd53a1500c9d9ebbd30e50e75699

    SHA512

    ae1f0e59b3f355bdd1046721fe91a8d4bcf732baf097b5b65847b6e1ba731da910c540f84d51aed8d1286c539534c59f2368b8a32e1daa680a3d498e3aad4008

  • \Users\Admin\AppData\Local\Temp\Pvjkdebv.exe
    Filesize

    272KB

    MD5

    1c57b1ffb059b7cd3a7cd64f8658eef0

    SHA1

    e89a4d44e48ab1b80cc4386d10b7bde4467bcd4b

    SHA256

    7f2fb08742f42d241cdb1936fc5f18a7ee05dd53a1500c9d9ebbd30e50e75699

    SHA512

    ae1f0e59b3f355bdd1046721fe91a8d4bcf732baf097b5b65847b6e1ba731da910c540f84d51aed8d1286c539534c59f2368b8a32e1daa680a3d498e3aad4008

  • \Users\Admin\AppData\Local\Temp\Pvjkdebv.exe
    Filesize

    272KB

    MD5

    1c57b1ffb059b7cd3a7cd64f8658eef0

    SHA1

    e89a4d44e48ab1b80cc4386d10b7bde4467bcd4b

    SHA256

    7f2fb08742f42d241cdb1936fc5f18a7ee05dd53a1500c9d9ebbd30e50e75699

    SHA512

    ae1f0e59b3f355bdd1046721fe91a8d4bcf732baf097b5b65847b6e1ba731da910c540f84d51aed8d1286c539534c59f2368b8a32e1daa680a3d498e3aad4008

  • \Users\Admin\AppData\Local\Temp\Pvjkdebv.exe
    Filesize

    272KB

    MD5

    1c57b1ffb059b7cd3a7cd64f8658eef0

    SHA1

    e89a4d44e48ab1b80cc4386d10b7bde4467bcd4b

    SHA256

    7f2fb08742f42d241cdb1936fc5f18a7ee05dd53a1500c9d9ebbd30e50e75699

    SHA512

    ae1f0e59b3f355bdd1046721fe91a8d4bcf732baf097b5b65847b6e1ba731da910c540f84d51aed8d1286c539534c59f2368b8a32e1daa680a3d498e3aad4008

  • \Users\Admin\AppData\Local\Temp\Pvjkdebv.exe
    Filesize

    272KB

    MD5

    1c57b1ffb059b7cd3a7cd64f8658eef0

    SHA1

    e89a4d44e48ab1b80cc4386d10b7bde4467bcd4b

    SHA256

    7f2fb08742f42d241cdb1936fc5f18a7ee05dd53a1500c9d9ebbd30e50e75699

    SHA512

    ae1f0e59b3f355bdd1046721fe91a8d4bcf732baf097b5b65847b6e1ba731da910c540f84d51aed8d1286c539534c59f2368b8a32e1daa680a3d498e3aad4008

  • \Users\Admin\AppData\Local\Temp\Pvjkdebv.exe
    Filesize

    272KB

    MD5

    1c57b1ffb059b7cd3a7cd64f8658eef0

    SHA1

    e89a4d44e48ab1b80cc4386d10b7bde4467bcd4b

    SHA256

    7f2fb08742f42d241cdb1936fc5f18a7ee05dd53a1500c9d9ebbd30e50e75699

    SHA512

    ae1f0e59b3f355bdd1046721fe91a8d4bcf732baf097b5b65847b6e1ba731da910c540f84d51aed8d1286c539534c59f2368b8a32e1daa680a3d498e3aad4008

  • \Users\Admin\AppData\Local\Temp\Pvjkdebv.exe
    Filesize

    272KB

    MD5

    1c57b1ffb059b7cd3a7cd64f8658eef0

    SHA1

    e89a4d44e48ab1b80cc4386d10b7bde4467bcd4b

    SHA256

    7f2fb08742f42d241cdb1936fc5f18a7ee05dd53a1500c9d9ebbd30e50e75699

    SHA512

    ae1f0e59b3f355bdd1046721fe91a8d4bcf732baf097b5b65847b6e1ba731da910c540f84d51aed8d1286c539534c59f2368b8a32e1daa680a3d498e3aad4008

  • memory/1096-85-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

  • memory/1096-80-0x000000000041A684-mapping.dmp
  • memory/1332-88-0x0000000000000000-mapping.dmp
  • memory/1460-69-0x0000000002570000-0x0000000002577000-memory.dmp
    Filesize

    28KB

  • memory/1460-56-0x00000000769D1000-0x00000000769D3000-memory.dmp
    Filesize

    8KB

  • memory/1660-75-0x0000000000417A8B-mapping.dmp
  • memory/1660-86-0x0000000000400000-0x0000000000434000-memory.dmp
    Filesize

    208KB

  • memory/1700-87-0x0000000000400000-0x0000000000493000-memory.dmp
    Filesize

    588KB

  • memory/1700-78-0x000000000043FA98-mapping.dmp
  • memory/1808-64-0x0000000000000000-mapping.dmp
  • memory/1980-59-0x0000000000000000-mapping.dmp
  • memory/1980-71-0x0000000000240000-0x0000000000247000-memory.dmp
    Filesize

    28KB