Analysis
-
max time kernel
177s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-06-2022 02:02
Static task
static1
Behavioral task
behavioral1
Sample
8f226e81f2d25f9f3e2e741a0d3487128144583d79de64d903f1121fde9f42d3.exe
Resource
win7-20220414-en
General
-
Target
8f226e81f2d25f9f3e2e741a0d3487128144583d79de64d903f1121fde9f42d3.exe
-
Size
2.3MB
-
MD5
6c3765191111fc238bbfedf10df00d16
-
SHA1
343e2816c224b1ad0583c352002c041dc872d329
-
SHA256
8f226e81f2d25f9f3e2e741a0d3487128144583d79de64d903f1121fde9f42d3
-
SHA512
35fcaccbcc69aeb2f2112b5824ae9e5cff8c1853e1bef9c89705b4c1c882b06d809301c2c077d6d4a42c0729945f2aa6c611b5453fa87c6de6ae50936b086bc1
Malware Config
Extracted
raccoon
Extracted
raccoon
0380ce78e535082bef76630d0bceca437f338548
-
url4cnc
https://drive.google.com/uc?export=download&id=1k0ymweaEst-OA_Um-D42KX8-DcDnmEAz
Signatures
-
Raccoon Stealer Payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/4176-130-0x0000000000100000-0x000000000059E000-memory.dmp family_raccoon behavioral2/memory/4176-131-0x0000000000100000-0x000000000059E000-memory.dmp family_raccoon behavioral2/memory/4176-132-0x0000000000100000-0x000000000059E000-memory.dmp family_raccoon behavioral2/memory/4176-133-0x0000000000100000-0x000000000059E000-memory.dmp family_raccoon behavioral2/memory/4176-134-0x0000000000100000-0x000000000059E000-memory.dmp family_raccoon -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
8f226e81f2d25f9f3e2e741a0d3487128144583d79de64d903f1121fde9f42d3.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 8f226e81f2d25f9f3e2e741a0d3487128144583d79de64d903f1121fde9f42d3.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
8f226e81f2d25f9f3e2e741a0d3487128144583d79de64d903f1121fde9f42d3.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8f226e81f2d25f9f3e2e741a0d3487128144583d79de64d903f1121fde9f42d3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 8f226e81f2d25f9f3e2e741a0d3487128144583d79de64d903f1121fde9f42d3.exe -
Processes:
resource yara_rule behavioral2/memory/4176-130-0x0000000000100000-0x000000000059E000-memory.dmp themida behavioral2/memory/4176-131-0x0000000000100000-0x000000000059E000-memory.dmp themida behavioral2/memory/4176-132-0x0000000000100000-0x000000000059E000-memory.dmp themida behavioral2/memory/4176-133-0x0000000000100000-0x000000000059E000-memory.dmp themida behavioral2/memory/4176-134-0x0000000000100000-0x000000000059E000-memory.dmp themida -
Processes:
8f226e81f2d25f9f3e2e741a0d3487128144583d79de64d903f1121fde9f42d3.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8f226e81f2d25f9f3e2e741a0d3487128144583d79de64d903f1121fde9f42d3.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 60 4176 WerFault.exe 8f226e81f2d25f9f3e2e741a0d3487128144583d79de64d903f1121fde9f42d3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f226e81f2d25f9f3e2e741a0d3487128144583d79de64d903f1121fde9f42d3.exe"C:\Users\Admin\AppData\Local\Temp\8f226e81f2d25f9f3e2e741a0d3487128144583d79de64d903f1121fde9f42d3.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 11122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4176 -ip 41761⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4176-130-0x0000000000100000-0x000000000059E000-memory.dmpFilesize
4.6MB
-
memory/4176-131-0x0000000000100000-0x000000000059E000-memory.dmpFilesize
4.6MB
-
memory/4176-132-0x0000000000100000-0x000000000059E000-memory.dmpFilesize
4.6MB
-
memory/4176-133-0x0000000000100000-0x000000000059E000-memory.dmpFilesize
4.6MB
-
memory/4176-134-0x0000000000100000-0x000000000059E000-memory.dmpFilesize
4.6MB