Analysis

  • max time kernel
    132s
  • max time network
    317s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    21-06-2022 03:44

General

  • Target

    ae46253a19c9e846c405b3926655efead40d8f873fef008f896019f34d486dfe.exe

  • Size

    7.2MB

  • MD5

    fc0c8c94d1c1463033a52735b09b8543

  • SHA1

    a389c3e50ad4126db350a8a152a328c6940a45a8

  • SHA256

    ae46253a19c9e846c405b3926655efead40d8f873fef008f896019f34d486dfe

  • SHA512

    26ff92befc374874331268ba9f39b2cc3b88dd0d102e6f8c5c7fb1147a09f92d5ba039f37a20b7d9a616c5826ccf72e332287c9787ec39e46003a28896a338ce

Malware Config

Signatures

  • Raccoon ver2 4 IoCs

    Raccoon ver2.

  • RecordBreaker

    RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

  • suricata: ET MALWARE Generic Stealer Config Download Request

    suricata: ET MALWARE Generic Stealer Config Download Request

  • suricata: ET MALWARE Recordbreaker Stealer CnC Checkin

    suricata: ET MALWARE Recordbreaker Stealer CnC Checkin

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae46253a19c9e846c405b3926655efead40d8f873fef008f896019f34d486dfe.exe
    "C:\Users\Admin\AppData\Local\Temp\ae46253a19c9e846c405b3926655efead40d8f873fef008f896019f34d486dfe.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:3896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3896-114-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-115-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-116-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-117-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-118-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-119-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-120-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-121-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-122-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-123-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-124-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-125-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-126-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-127-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-128-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-129-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-130-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-131-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-132-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-133-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-134-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-135-0x00000000000A0000-0x0000000000BE6000-memory.dmp

    Filesize

    11.3MB

  • memory/3896-136-0x00000000000A0000-0x0000000000BE6000-memory.dmp

    Filesize

    11.3MB

  • memory/3896-138-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-139-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-140-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-141-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-142-0x00000000000A0000-0x0000000000BE6000-memory.dmp

    Filesize

    11.3MB

  • memory/3896-143-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-144-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-145-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-146-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-147-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-148-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-149-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-150-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-151-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-152-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-153-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-154-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-155-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-157-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-158-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-156-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-160-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-161-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-159-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-162-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-163-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-164-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-165-0x0000000077160000-0x00000000772EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3896-166-0x00000000000A0000-0x0000000000BE6000-memory.dmp

    Filesize

    11.3MB