Analysis

  • max time kernel
    54s
  • max time network
    184s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    21-06-2022 03:18

General

  • Target

    a988a4f3652eaa34b874080da1cbb70223bac6760e318064f4f23b69bf823330.exe

  • Size

    4.1MB

  • MD5

    2ae15c4884a84f7b4f9fb4f461d6936c

  • SHA1

    d4a55f83d824ae541212c714b842487f21270435

  • SHA256

    a988a4f3652eaa34b874080da1cbb70223bac6760e318064f4f23b69bf823330

  • SHA512

    ac54be94cb04914f6cbb4cba1c832b5a243cfc97cfa21334a3041b21b5ebbe3c4b1cbe7ca124eb85ccc2a6729db6a0b0942d955ed26c8e154e91815e40502c84

Malware Config

Extracted

Family

recordbreaker

C2

http://5.252.22.62/

Signatures

  • Raccoon ver2 5 IoCs

    Raccoon ver2.

  • RecordBreaker

    RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a988a4f3652eaa34b874080da1cbb70223bac6760e318064f4f23b69bf823330.exe
    "C:\Users\Admin\AppData\Local\Temp\a988a4f3652eaa34b874080da1cbb70223bac6760e318064f4f23b69bf823330.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:1784

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1784-115-0x0000000000250000-0x0000000000AAD000-memory.dmp
    Filesize

    8.4MB

  • memory/1784-114-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-116-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-117-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-118-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-119-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-120-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-121-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-122-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-123-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-124-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-126-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-125-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-127-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-128-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-129-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-130-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-131-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-132-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-133-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-134-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-135-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-136-0x0000000000250000-0x0000000000AAD000-memory.dmp
    Filesize

    8.4MB

  • memory/1784-140-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-141-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-142-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-144-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-143-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-145-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-146-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-147-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-148-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-149-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-150-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-151-0x0000000000250000-0x0000000000AAD000-memory.dmp
    Filesize

    8.4MB

  • memory/1784-152-0x0000000000250000-0x0000000000AAD000-memory.dmp
    Filesize

    8.4MB

  • memory/1784-153-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-154-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-155-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-156-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-157-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-158-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-159-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-160-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-161-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-162-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-163-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-164-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-165-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-166-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-167-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-168-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-170-0x0000000000250000-0x0000000000AAD000-memory.dmp
    Filesize

    8.4MB

  • memory/1784-169-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-171-0x0000000076F70000-0x00000000770FE000-memory.dmp
    Filesize

    1.6MB

  • memory/1784-172-0x0000000000250000-0x0000000000AAD000-memory.dmp
    Filesize

    8.4MB