Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
05-08-2022 17:46
Behavioral task
behavioral1
Sample
35ffc986d369b7ebda2e69d37cfac6b8.exe
Resource
win7-20220715-en
windows7-x64
9 signatures
150 seconds
General
-
Target
35ffc986d369b7ebda2e69d37cfac6b8.exe
-
Size
2.6MB
-
MD5
35ffc986d369b7ebda2e69d37cfac6b8
-
SHA1
fe80513205e9176a156f2e00ea9762baa6131a0f
-
SHA256
5b037a43064259317c81f5f4192fc8b54cd218d3d9772201ec52b0680453ceb4
-
SHA512
fed41f9b20cf370f93507663bf583f762d61fda3df1908aed4238992fe1f15822f8a783c802e9789f8b10aaa4d128831365c6866d1abea46044093a927622640
Malware Config
Extracted
Family
raccoon
Botnet
95a5f22777e49d40d70bf77aadccdc5c
C2
http://193.43.147.6/
rc4.plain
Signatures
-
Raccoon Stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1488-141-0x0000000000400000-0x0000000000411000-memory.dmp family_raccoon behavioral2/memory/1488-143-0x0000000000400000-0x0000000000411000-memory.dmp family_raccoon behavioral2/memory/1488-144-0x0000000000400000-0x0000000000411000-memory.dmp family_raccoon behavioral2/memory/1488-147-0x0000000000400000-0x0000000000411000-memory.dmp family_raccoon -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
35ffc986d369b7ebda2e69d37cfac6b8.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 35ffc986d369b7ebda2e69d37cfac6b8.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
35ffc986d369b7ebda2e69d37cfac6b8.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 35ffc986d369b7ebda2e69d37cfac6b8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 35ffc986d369b7ebda2e69d37cfac6b8.exe -
Processes:
resource yara_rule behavioral2/memory/624-130-0x0000000000400000-0x0000000000885000-memory.dmp themida behavioral2/memory/624-133-0x0000000000400000-0x0000000000885000-memory.dmp themida behavioral2/memory/624-145-0x0000000000400000-0x0000000000885000-memory.dmp themida -
Processes:
35ffc986d369b7ebda2e69d37cfac6b8.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 35ffc986d369b7ebda2e69d37cfac6b8.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
35ffc986d369b7ebda2e69d37cfac6b8.exedescription pid process target process PID 624 set thread context of 1488 624 35ffc986d369b7ebda2e69d37cfac6b8.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
35ffc986d369b7ebda2e69d37cfac6b8.exepid process 624 35ffc986d369b7ebda2e69d37cfac6b8.exe 624 35ffc986d369b7ebda2e69d37cfac6b8.exe 624 35ffc986d369b7ebda2e69d37cfac6b8.exe 624 35ffc986d369b7ebda2e69d37cfac6b8.exe 624 35ffc986d369b7ebda2e69d37cfac6b8.exe 624 35ffc986d369b7ebda2e69d37cfac6b8.exe 624 35ffc986d369b7ebda2e69d37cfac6b8.exe 624 35ffc986d369b7ebda2e69d37cfac6b8.exe 624 35ffc986d369b7ebda2e69d37cfac6b8.exe 624 35ffc986d369b7ebda2e69d37cfac6b8.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
35ffc986d369b7ebda2e69d37cfac6b8.exedescription pid process target process PID 624 wrote to memory of 1488 624 35ffc986d369b7ebda2e69d37cfac6b8.exe InstallUtil.exe PID 624 wrote to memory of 1488 624 35ffc986d369b7ebda2e69d37cfac6b8.exe InstallUtil.exe PID 624 wrote to memory of 1488 624 35ffc986d369b7ebda2e69d37cfac6b8.exe InstallUtil.exe PID 624 wrote to memory of 1488 624 35ffc986d369b7ebda2e69d37cfac6b8.exe InstallUtil.exe PID 624 wrote to memory of 1488 624 35ffc986d369b7ebda2e69d37cfac6b8.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35ffc986d369b7ebda2e69d37cfac6b8.exe"C:\Users\Admin\AppData\Local\Temp\35ffc986d369b7ebda2e69d37cfac6b8.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/624-145-0x0000000000400000-0x0000000000885000-memory.dmpFilesize
4.5MB
-
memory/624-131-0x00000000027C8000-0x0000000002BB3000-memory.dmpFilesize
3.9MB
-
memory/624-132-0x0000000002625000-0x000000000276E000-memory.dmpFilesize
1.3MB
-
memory/624-133-0x0000000000400000-0x0000000000885000-memory.dmpFilesize
4.5MB
-
memory/624-134-0x00000000027C8000-0x0000000002BB3000-memory.dmpFilesize
3.9MB
-
memory/624-135-0x0000000002625000-0x000000000276E000-memory.dmpFilesize
1.3MB
-
memory/624-136-0x000000000E730000-0x000000000E7EB000-memory.dmpFilesize
748KB
-
memory/624-137-0x000000000E730000-0x000000000E7EB000-memory.dmpFilesize
748KB
-
memory/624-130-0x0000000000400000-0x0000000000885000-memory.dmpFilesize
4.5MB
-
memory/624-146-0x0000000002625000-0x000000000276E000-memory.dmpFilesize
1.3MB
-
memory/1488-138-0x0000000000000000-mapping.dmp
-
memory/1488-143-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1488-144-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1488-141-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1488-139-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1488-147-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB