Analysis
-
max time kernel
78s -
max time network
81s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
24-09-2022 03:13
Static task
static1
Behavioral task
behavioral1
Sample
autoplay.exe
Resource
win10-20220812-en
Behavioral task
behavioral2
Sample
autorun.dll
Resource
win10-20220812-en
General
-
Target
autoplay.exe
-
Size
2.5MB
-
MD5
c4379188fbebcf19fb52982a07ad97e5
-
SHA1
5959c3a2c4173a2ac35dda00692dd5b402b950ad
-
SHA256
0933f4936176e06ade6b661f36423892a9553e92cf1d4ad8e20cfb9a83dc029c
-
SHA512
e55ef130b26a3056bd5a1dfef2ef57bf28fe541d4b3903c238d308c8f1a999e20349a695c3ee420ac0ca77015bdfd4d9afda7c8982a6804ea7073c62f9253228
-
SSDEEP
49152:KR+W+FYXeCasCDnkh4bC6ZD40PFL/xl3V:KR+W+F6eCZCDnkh+40PFL/V
Malware Config
Extracted
raccoon
82b47b435e53e7fb9a7380684546ba5c
http://77.73.133.23/
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
P6lh6DT5.exepid process 102188 P6lh6DT5.exe -
Loads dropped DLL 3 IoCs
Processes:
AppLaunch.exepid process 101708 AppLaunch.exe 101708 AppLaunch.exe 101708 AppLaunch.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
autoplay.exeP6lh6DT5.exedescription pid process target process PID 4248 set thread context of 101708 4248 autoplay.exe AppLaunch.exe PID 102188 set thread context of 101696 102188 P6lh6DT5.exe AppLaunch.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
autoplay.exeAppLaunch.exeP6lh6DT5.exedescription pid process target process PID 4248 wrote to memory of 101708 4248 autoplay.exe AppLaunch.exe PID 4248 wrote to memory of 101708 4248 autoplay.exe AppLaunch.exe PID 4248 wrote to memory of 101708 4248 autoplay.exe AppLaunch.exe PID 4248 wrote to memory of 101708 4248 autoplay.exe AppLaunch.exe PID 4248 wrote to memory of 101708 4248 autoplay.exe AppLaunch.exe PID 101708 wrote to memory of 102188 101708 AppLaunch.exe P6lh6DT5.exe PID 101708 wrote to memory of 102188 101708 AppLaunch.exe P6lh6DT5.exe PID 101708 wrote to memory of 102188 101708 AppLaunch.exe P6lh6DT5.exe PID 102188 wrote to memory of 101696 102188 P6lh6DT5.exe AppLaunch.exe PID 102188 wrote to memory of 101696 102188 P6lh6DT5.exe AppLaunch.exe PID 102188 wrote to memory of 101696 102188 P6lh6DT5.exe AppLaunch.exe PID 102188 wrote to memory of 101696 102188 P6lh6DT5.exe AppLaunch.exe PID 102188 wrote to memory of 101696 102188 P6lh6DT5.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\autoplay.exe"C:\Users\Admin\AppData\Local\Temp\autoplay.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\P6lh6DT5.exe"C:\Users\Admin\AppData\Roaming\P6lh6DT5.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\P6lh6DT5.exeFilesize
3.2MB
MD5872cdcada5bfb5e36981c45825e4fef0
SHA13d33e62634752087f873432343952e482e950283
SHA2566b9ce9305643a49e11668d09319671b49504563b7b0eecc801ec860b63dad5c0
SHA51229f9862be04c8edf7a7586dd317022aab2fe6466c257e1cd6dce6b0081dde5cbfc1cd6cfc1e030803771bc7b9db27c4af83ce5bff5c01bb14e84037874257bea
-
C:\Users\Admin\AppData\Roaming\P6lh6DT5.exeFilesize
3.2MB
MD5872cdcada5bfb5e36981c45825e4fef0
SHA13d33e62634752087f873432343952e482e950283
SHA2566b9ce9305643a49e11668d09319671b49504563b7b0eecc801ec860b63dad5c0
SHA51229f9862be04c8edf7a7586dd317022aab2fe6466c257e1cd6dce6b0081dde5cbfc1cd6cfc1e030803771bc7b9db27c4af83ce5bff5c01bb14e84037874257bea
-
\Users\Admin\AppData\LocalLow\mozglue.dllFilesize
612KB
MD5f07d9977430e762b563eaadc2b94bbfa
SHA1da0a05b2b8d269fb73558dfcf0ed5c167f6d3877
SHA2564191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862
SHA5126afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf
-
\Users\Admin\AppData\LocalLow\nss3.dllFilesize
1.9MB
MD5f67d08e8c02574cbc2f1122c53bfb976
SHA16522992957e7e4d074947cad63189f308a80fcf2
SHA256c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e
SHA5122e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5
-
\Users\Admin\AppData\LocalLow\sqlite3.dllFilesize
1.0MB
MD5dbf4f8dcefb8056dc6bae4b67ff810ce
SHA1bbac1dd8a07c6069415c04b62747d794736d0689
SHA25647b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68
SHA512b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1
-
memory/4248-151-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-126-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-121-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-122-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-123-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-124-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-125-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-157-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-127-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-129-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-128-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-130-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-131-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-132-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-133-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-134-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-135-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-136-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-137-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-138-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-140-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-141-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-142-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-144-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-146-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-147-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-149-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-119-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-153-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-155-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-154-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-156-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-120-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-152-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-150-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-148-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-145-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-143-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/4248-139-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/101696-307-0x00000000007167D3-mapping.dmp
-
memory/101708-175-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/101708-169-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/101708-173-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/101708-178-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/101708-177-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/101708-170-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/101708-171-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/101708-176-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/101708-165-0x00000000001A8597-mapping.dmp
-
memory/101708-172-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/101708-167-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/101708-166-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/101708-168-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/101708-179-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/101708-158-0x00000000001A0000-0x00000000001B4000-memory.dmpFilesize
80KB
-
memory/101708-180-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/101708-181-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/101708-182-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/101708-174-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/101708-183-0x0000000076E80000-0x000000007700E000-memory.dmpFilesize
1.6MB
-
memory/102188-253-0x0000000000000000-mapping.dmp