Analysis
-
max time kernel
53s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
29-07-2022 18:53
Behavioral task
behavioral1
Sample
00FC3CD6E8696CF8EEA722198A6B7469.exe
Resource
win7-20220718-en
windows7-x64
8 signatures
150 seconds
General
-
Target
00FC3CD6E8696CF8EEA722198A6B7469.exe
-
Size
5.5MB
-
MD5
00fc3cd6e8696cf8eea722198a6b7469
-
SHA1
0f1b48ef3dab7a257ded76e016eb02ab6100218a
-
SHA256
2142d70eae48bea2173d8a1d161daa71546ae8a27e2719f0f013b723ffe7a0ec
-
SHA512
80f998440901e10637618056c9ce153682185ee1f66196a914c6ea9f870add90305547cd611cace3d0e74696bae7e8c9ea283780682286a3c392c4e259d0dec0
Malware Config
Extracted
Family
raccoon
Botnet
d498b1632d1cef90118cd87314063540
C2
http://80.66.87.43/
rc4.plain
Signatures
-
Raccoon Stealer payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/288-59-0x0000000000370000-0x0000000000E41000-memory.dmp family_raccoon behavioral1/memory/288-60-0x0000000000370000-0x0000000000E41000-memory.dmp family_raccoon behavioral1/memory/288-62-0x0000000000370000-0x0000000000E41000-memory.dmp family_raccoon behavioral1/memory/288-63-0x0000000000370000-0x0000000000E41000-memory.dmp family_raccoon -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
00FC3CD6E8696CF8EEA722198A6B7469.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 00FC3CD6E8696CF8EEA722198A6B7469.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
00FC3CD6E8696CF8EEA722198A6B7469.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 00FC3CD6E8696CF8EEA722198A6B7469.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 00FC3CD6E8696CF8EEA722198A6B7469.exe -
Processes:
resource yara_rule behavioral1/memory/288-54-0x0000000000370000-0x0000000000E41000-memory.dmp themida behavioral1/memory/288-58-0x0000000000370000-0x0000000000E41000-memory.dmp themida behavioral1/memory/288-59-0x0000000000370000-0x0000000000E41000-memory.dmp themida behavioral1/memory/288-60-0x0000000000370000-0x0000000000E41000-memory.dmp themida behavioral1/memory/288-62-0x0000000000370000-0x0000000000E41000-memory.dmp themida behavioral1/memory/288-63-0x0000000000370000-0x0000000000E41000-memory.dmp themida -
Processes:
00FC3CD6E8696CF8EEA722198A6B7469.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 00FC3CD6E8696CF8EEA722198A6B7469.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
00FC3CD6E8696CF8EEA722198A6B7469.exepid process 288 00FC3CD6E8696CF8EEA722198A6B7469.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
00FC3CD6E8696CF8EEA722198A6B7469.exepid process 288 00FC3CD6E8696CF8EEA722198A6B7469.exe 288 00FC3CD6E8696CF8EEA722198A6B7469.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00FC3CD6E8696CF8EEA722198A6B7469.exe"C:\Users\Admin\AppData\Local\Temp\00FC3CD6E8696CF8EEA722198A6B7469.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/288-54-0x0000000000370000-0x0000000000E41000-memory.dmpFilesize
10.8MB
-
memory/288-57-0x0000000076921000-0x0000000076923000-memory.dmpFilesize
8KB
-
memory/288-58-0x0000000000370000-0x0000000000E41000-memory.dmpFilesize
10.8MB
-
memory/288-59-0x0000000000370000-0x0000000000E41000-memory.dmpFilesize
10.8MB
-
memory/288-60-0x0000000000370000-0x0000000000E41000-memory.dmpFilesize
10.8MB
-
memory/288-61-0x0000000077980000-0x0000000077B00000-memory.dmpFilesize
1.5MB
-
memory/288-62-0x0000000000370000-0x0000000000E41000-memory.dmpFilesize
10.8MB
-
memory/288-63-0x0000000000370000-0x0000000000E41000-memory.dmpFilesize
10.8MB
-
memory/288-64-0x0000000077980000-0x0000000077B00000-memory.dmpFilesize
1.5MB