Analysis

  • max time kernel
    310s
  • max time network
    323s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    21-06-2022 03:43

General

  • Target

    b7104e1420fbcdd4a78b02069f32d4882d38203dcb5f73509b60cc1567dac437.exe

  • Size

    392.0MB

  • MD5

    8a121fd92c5ccf804f7682de0aa4f685

  • SHA1

    5723e27841445373e1816ef142aa80970ae1d469

  • SHA256

    b7104e1420fbcdd4a78b02069f32d4882d38203dcb5f73509b60cc1567dac437

  • SHA512

    368aa322e2884a75d4afa16c4c092f1cbf989f1fa8193744be224bed474c7fa13acf0996944b3bab74e72cf7fb8b53e50a6ef3a454f12c4a4c7ecb0bc80503cd

Malware Config

Extracted

Family

recordbreaker

C2

http://violance-heck.site/

http://roll-rave.site/

Signatures

  • Raccoon ver2 4 IoCs

    Raccoon ver2.

  • RecordBreaker

    RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • VMProtect packed file 7 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 7 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b7104e1420fbcdd4a78b02069f32d4882d38203dcb5f73509b60cc1567dac437.exe
    "C:\Users\Admin\AppData\Local\Temp\b7104e1420fbcdd4a78b02069f32d4882d38203dcb5f73509b60cc1567dac437.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:1752

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1752-119-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-120-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-121-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-122-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-123-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-124-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-126-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-125-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-127-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-128-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-130-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-131-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-129-0x00000000010E0000-0x0000000001AD5000-memory.dmp
    Filesize

    10.0MB

  • memory/1752-132-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-133-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-134-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-135-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-136-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-137-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-138-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-139-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-140-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-141-0x00000000010E0000-0x0000000001AD5000-memory.dmp
    Filesize

    10.0MB

  • memory/1752-146-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-147-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-148-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-149-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-150-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-151-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-152-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-154-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-153-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-155-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-156-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-157-0x00000000010E0000-0x0000000001AD5000-memory.dmp
    Filesize

    10.0MB

  • memory/1752-158-0x00000000010E0000-0x0000000001AD5000-memory.dmp
    Filesize

    10.0MB

  • memory/1752-159-0x00000000010E0000-0x0000000001AD5000-memory.dmp
    Filesize

    10.0MB

  • memory/1752-160-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-161-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-162-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-163-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-164-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-165-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-166-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-167-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-168-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-169-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-170-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-171-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-172-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-173-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-174-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-175-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-176-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-177-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-178-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-179-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-180-0x0000000077E60000-0x0000000077FEE000-memory.dmp
    Filesize

    1.6MB

  • memory/1752-181-0x00000000010E0000-0x0000000001AD5000-memory.dmp
    Filesize

    10.0MB

  • memory/1752-182-0x00000000010E0000-0x0000000001AD5000-memory.dmp
    Filesize

    10.0MB