Analysis
-
max time kernel
45s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02-09-2022 08:47
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
General
-
Target
file.exe
-
Size
6.6MB
-
MD5
83fd77104c17653424a3d3894dbe8793
-
SHA1
fbd8618f1d840c2506b33e85df7be7abf6753c19
-
SHA256
4d70a2e9f63fea018db99bef6cecbf094255c52f6e2bd9d1d7458e637efb9172
-
SHA512
18c577e3fa7b48cd7a2954fa9c132a023d8c64809aa1887969ecb35cbb188efc87a0013d9b41a83d4bc701ffb496e6914331e48f84de39382848213f559566a9
-
SSDEEP
196608:fOo36KhbbRT3Z7/OXnKO8/tPp0ll9z3d0dppIbh5:djbDmXl60bz
Malware Config
Extracted
raccoon
ad82482251879b6e89002f532531462a
http://89.185.85.53/
Signatures
-
YTStealer payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1692-79-0x0000000000EC0000-0x0000000001CD4000-memory.dmp family_ytstealer behavioral1/memory/1692-81-0x0000000000EC0000-0x0000000001CD4000-memory.dmp family_ytstealer -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
x2LNP961.exe76JtD2JO.exepid process 1808 x2LNP961.exe 1692 76JtD2JO.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\76JtD2JO.exe upx \Users\Admin\AppData\Roaming\76JtD2JO.exe upx C:\Users\Admin\AppData\Roaming\76JtD2JO.exe upx behavioral1/memory/1692-79-0x0000000000EC0000-0x0000000001CD4000-memory.dmp upx behavioral1/memory/1692-81-0x0000000000EC0000-0x0000000001CD4000-memory.dmp upx -
Loads dropped DLL 6 IoCs
Processes:
file.exepid process 1168 file.exe 1168 file.exe 1168 file.exe 1168 file.exe 1168 file.exe 1168 file.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
file.exex2LNP961.exepid process 1168 file.exe 1168 file.exe 1808 x2LNP961.exe 1808 x2LNP961.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
file.exex2LNP961.exepid process 1168 file.exe 1808 x2LNP961.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
file.exex2LNP961.exedescription pid process target process PID 1168 wrote to memory of 1808 1168 file.exe x2LNP961.exe PID 1168 wrote to memory of 1808 1168 file.exe x2LNP961.exe PID 1168 wrote to memory of 1808 1168 file.exe x2LNP961.exe PID 1168 wrote to memory of 1808 1168 file.exe x2LNP961.exe PID 1808 wrote to memory of 1540 1808 x2LNP961.exe schtasks.exe PID 1808 wrote to memory of 1540 1808 x2LNP961.exe schtasks.exe PID 1808 wrote to memory of 1540 1808 x2LNP961.exe schtasks.exe PID 1808 wrote to memory of 1540 1808 x2LNP961.exe schtasks.exe PID 1168 wrote to memory of 1692 1168 file.exe 76JtD2JO.exe PID 1168 wrote to memory of 1692 1168 file.exe 76JtD2JO.exe PID 1168 wrote to memory of 1692 1168 file.exe 76JtD2JO.exe PID 1168 wrote to memory of 1692 1168 file.exe 76JtD2JO.exe PID 1808 wrote to memory of 1956 1808 x2LNP961.exe schtasks.exe PID 1808 wrote to memory of 1956 1808 x2LNP961.exe schtasks.exe PID 1808 wrote to memory of 1956 1808 x2LNP961.exe schtasks.exe PID 1808 wrote to memory of 1956 1808 x2LNP961.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\x2LNP961.exe"C:\Users\Admin\AppData\Roaming\x2LNP961.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 5 /tn "Shell Infrastructure Host Task {H5J7S8H9D6-2S6E8R2K4-8G6M3C2D3E}" /tr "C:\Users\Admin\AppData\Roaming\Windows\System32\sihost.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe/C /Query /XML /TN "Shell Infrastructure Host Task {H5J7S8H9D6-2S6E8R2K4-8G6M3C2D3E}"3⤵
-
C:\Users\Admin\AppData\Roaming\76JtD2JO.exe"C:\Users\Admin\AppData\Roaming\76JtD2JO.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\76JtD2JO.exeFilesize
4.0MB
MD596ec3efa9bd454550b615df142b08295
SHA14a8a6d3a8d94f02194822c2066e11800a518c8d6
SHA2566d5320cd6e4cfc208f6703fff254b6f1363e1afdf7d8e77155549a674fa3a263
SHA5128e3945604e8992d3630ae716e09d3a9a3052a2ddbccf15bcaac9b636a0a49879552cbd58f299ddc6b4dd7e8b6e915c29b35bfc3a0a3f449c41f7caae776c0b6b
-
C:\Users\Admin\AppData\Roaming\x2LNP961.exeFilesize
6.1MB
MD5a0cce836755a2b064842089d16ea5561
SHA1fa0a6251130f3a0008a136393a959e6a8f611139
SHA2560f2a54e667aae6db7283b8d6340e9ebd8cac4a740190e65a02b18fb55cd2af01
SHA51254f7c38e80a0822ff7079c3742eaf61de84d9404c69af75c310e5308b9f41cd2e99a40536c7605cb3f1cfc18afc1fd3f0acd82b98ef42cd1802e2c9550205813
-
C:\Users\Admin\AppData\Roaming\x2LNP961.exeFilesize
6.1MB
MD5a0cce836755a2b064842089d16ea5561
SHA1fa0a6251130f3a0008a136393a959e6a8f611139
SHA2560f2a54e667aae6db7283b8d6340e9ebd8cac4a740190e65a02b18fb55cd2af01
SHA51254f7c38e80a0822ff7079c3742eaf61de84d9404c69af75c310e5308b9f41cd2e99a40536c7605cb3f1cfc18afc1fd3f0acd82b98ef42cd1802e2c9550205813
-
\Users\Admin\AppData\LocalLow\mozglue.dllFilesize
612KB
MD5f07d9977430e762b563eaadc2b94bbfa
SHA1da0a05b2b8d269fb73558dfcf0ed5c167f6d3877
SHA2564191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862
SHA5126afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf
-
\Users\Admin\AppData\LocalLow\nss3.dllFilesize
1.9MB
MD5f67d08e8c02574cbc2f1122c53bfb976
SHA16522992957e7e4d074947cad63189f308a80fcf2
SHA256c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e
SHA5122e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5
-
\Users\Admin\AppData\LocalLow\sqlite3.dllFilesize
1.0MB
MD5dbf4f8dcefb8056dc6bae4b67ff810ce
SHA1bbac1dd8a07c6069415c04b62747d794736d0689
SHA25647b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68
SHA512b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1
-
\Users\Admin\AppData\Roaming\76JtD2JO.exeFilesize
4.0MB
MD596ec3efa9bd454550b615df142b08295
SHA14a8a6d3a8d94f02194822c2066e11800a518c8d6
SHA2566d5320cd6e4cfc208f6703fff254b6f1363e1afdf7d8e77155549a674fa3a263
SHA5128e3945604e8992d3630ae716e09d3a9a3052a2ddbccf15bcaac9b636a0a49879552cbd58f299ddc6b4dd7e8b6e915c29b35bfc3a0a3f449c41f7caae776c0b6b
-
\Users\Admin\AppData\Roaming\76JtD2JO.exeFilesize
4.0MB
MD596ec3efa9bd454550b615df142b08295
SHA14a8a6d3a8d94f02194822c2066e11800a518c8d6
SHA2566d5320cd6e4cfc208f6703fff254b6f1363e1afdf7d8e77155549a674fa3a263
SHA5128e3945604e8992d3630ae716e09d3a9a3052a2ddbccf15bcaac9b636a0a49879552cbd58f299ddc6b4dd7e8b6e915c29b35bfc3a0a3f449c41f7caae776c0b6b
-
\Users\Admin\AppData\Roaming\x2LNP961.exeFilesize
6.1MB
MD5a0cce836755a2b064842089d16ea5561
SHA1fa0a6251130f3a0008a136393a959e6a8f611139
SHA2560f2a54e667aae6db7283b8d6340e9ebd8cac4a740190e65a02b18fb55cd2af01
SHA51254f7c38e80a0822ff7079c3742eaf61de84d9404c69af75c310e5308b9f41cd2e99a40536c7605cb3f1cfc18afc1fd3f0acd82b98ef42cd1802e2c9550205813
-
memory/1168-61-0x0000000000400000-0x0000000000E21000-memory.dmpFilesize
10.1MB
-
memory/1168-57-0x00000000760E1000-0x00000000760E3000-memory.dmpFilesize
8KB
-
memory/1168-76-0x0000000000400000-0x0000000000E21000-memory.dmpFilesize
10.1MB
-
memory/1168-77-0x0000000003E40000-0x0000000004C54000-memory.dmpFilesize
14.1MB
-
memory/1168-75-0x0000000003E40000-0x0000000004C54000-memory.dmpFilesize
14.1MB
-
memory/1168-56-0x0000000000400000-0x0000000000E21000-memory.dmpFilesize
10.1MB
-
memory/1168-54-0x0000000000400000-0x0000000000E21000-memory.dmpFilesize
10.1MB
-
memory/1540-70-0x0000000000000000-mapping.dmp
-
memory/1692-73-0x0000000000000000-mapping.dmp
-
memory/1692-79-0x0000000000EC0000-0x0000000001CD4000-memory.dmpFilesize
14.1MB
-
memory/1692-81-0x0000000000EC0000-0x0000000001CD4000-memory.dmpFilesize
14.1MB
-
memory/1808-63-0x0000000000000000-mapping.dmp
-
memory/1808-69-0x0000000000400000-0x0000000000D76000-memory.dmpFilesize
9.5MB
-
memory/1808-67-0x0000000000400000-0x0000000000D76000-memory.dmpFilesize
9.5MB
-
memory/1808-68-0x0000000000400000-0x0000000000D76000-memory.dmpFilesize
9.5MB
-
memory/1808-80-0x0000000000400000-0x0000000000D76000-memory.dmpFilesize
9.5MB
-
memory/1956-78-0x0000000000000000-mapping.dmp