Analysis
- max time kernel
76s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
11/09/2022, 06:48
General
- Target 9fae1c2fb440f524912b0a4b6d290b6f.exe
- Size 295KB
- Sample220911-hkshlsbbc8
- SHA256 570c8bfbfe83183e8cf87d989d2a0bee76da03f0db2061578629d3939a4a42f7
Malware Config
Extracted
-
raccoon
-
567d5bff28c2a18132d2f88511f07435
-
http://116.203.167.5/
-
http://195.201.248.58/
Signatures
- Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
- Downloads MZ/PE file
- Loads dropped DLL 3 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fae1c2fb440f524912b0a4b6d290b6f.exe"C:\Users\Admin\AppData\Local\Temp\9fae1c2fb440f524912b0a4b6d290b6f.exe"1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 14762⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3052 -ip 30521⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
mozglue.dll
nss3.dll
sqlite3.dll
memory/3052-132-0x0000000000B48000-0x0000000000B59000-memory.dmp
memory/3052-133-0x0000000000AE0000-0x0000000000AF0000-memory.dmp
memory/3052-134-0x0000000000400000-0x000000000084C000-memory.dmp
memory/3052-138-0x0000000000B48000-0x0000000000B59000-memory.dmp
memory/3052-139-0x0000000000400000-0x000000000084C000-memory.dmp
memory/3052-140-0x0000000000B48000-0x0000000000B59000-memory.dmp
memory/3052-141-0x0000000000400000-0x000000000084C000-memory.dmp