Analysis
-
max time kernel
150s -
max time network
178s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
21-06-2022 03:25
Static task
static1
Behavioral task
behavioral1
Sample
7503d528db92b909ad05d65379e6aae008dfaa3664bcac252d34d7a9f25b2db9.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
7503d528db92b909ad05d65379e6aae008dfaa3664bcac252d34d7a9f25b2db9.exe
Resource
win10-20220414-en
General
-
Target
7503d528db92b909ad05d65379e6aae008dfaa3664bcac252d34d7a9f25b2db9.exe
-
Size
181KB
-
MD5
ef18473cf2e8162c5671981437cf00a6
-
SHA1
0c85d6bf85611292c76331d7cc6690014a869fb6
-
SHA256
7503d528db92b909ad05d65379e6aae008dfaa3664bcac252d34d7a9f25b2db9
-
SHA512
fce1eb3ef6679ef97d7b1f76192c1195925e3c288c0097dda4ace87e0d610c1fc9cf5fcc7fd148986d5770e1e63ff2803e8072b4e1624007f12e60184cad0375
Malware Config
Extracted
recordbreaker
http://77.91.73.162/
Signatures
-
Raccoon ver2 2 IoCs
Raccoon ver2.
Processes:
resource yara_rule behavioral2/memory/4704-151-0x0000000000400000-0x00000000008F8000-memory.dmp raccoon_v2 behavioral2/memory/4704-174-0x0000000000400000-0x00000000008F8000-memory.dmp raccoon_v2 -
RecordBreaker
RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.
-
suricata: ET MALWARE Generic Stealer Config Download Request
suricata: ET MALWARE Generic Stealer Config Download Request
-
suricata: ET MALWARE Recordbreaker Stealer CnC Checkin
suricata: ET MALWARE Recordbreaker Stealer CnC Checkin
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.