Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-09-2022 04:32
Static task
static1
Behavioral task
behavioral1
Sample
lrPBx4qjVQLL.exe
Resource
win7-20220901-en
General
-
Target
lrPBx4qjVQLL.exe
-
Size
1.5MB
-
MD5
018dbebc18d0989b6c5a0916a7aeb8ee
-
SHA1
3d9d22ef47c09230fda8d66945e00e3538f2d975
-
SHA256
82112a8c76d6bab37acadc1e1a113e43b6dc966f48b9f2a0cc8fdbd844ee2f7a
-
SHA512
a97b649deaed7f44b03f882648dbaa26ebddc9d925e161d6b523a09861950efef17cb14339f22a92184ca9184abb92b04e2d4f07a7914ae0e091f4f2560adf96
-
SSDEEP
49152:8N0TnIUbWriymtRAZbUJylRyOuo+ecZTa1gBHXOlr/pQVpu7S/cY:gKnIUbWrJUJy/yOuo/cZTa1cXO/DS/b
Malware Config
Extracted
raccoon
9b19cf60d9bdf65b8a2495aa965456c3
http://94.131.107.206
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Q7j7XBa6.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Q7j7XBa6.exe -
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
0SjSYePw.exe8vl94O51.exeQ7j7XBa6.exe8vl94O51.exeDllResource.exepid process 4040 0SjSYePw.exe 1684 8vl94O51.exe 3244 Q7j7XBa6.exe 228 8vl94O51.exe 3976 DllResource.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Q7j7XBa6.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Q7j7XBa6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Q7j7XBa6.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
8vl94O51.exe0SjSYePw.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 8vl94O51.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 0SjSYePw.exe -
Loads dropped DLL 3 IoCs
Processes:
InstallUtil.exepid process 460 InstallUtil.exe 460 InstallUtil.exe 460 InstallUtil.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Q7j7XBa6.exe themida C:\Users\Admin\AppData\Local\Temp\Q7j7XBa6.exe themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Processes:
Q7j7XBa6.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Q7j7XBa6.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
lrPBx4qjVQLL.exe8vl94O51.exedescription pid process target process PID 892 set thread context of 460 892 lrPBx4qjVQLL.exe InstallUtil.exe PID 1684 set thread context of 228 1684 8vl94O51.exe 8vl94O51.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
lrPBx4qjVQLL.exe8vl94O51.exe0SjSYePw.exepid process 892 lrPBx4qjVQLL.exe 892 lrPBx4qjVQLL.exe 892 lrPBx4qjVQLL.exe 892 lrPBx4qjVQLL.exe 892 lrPBx4qjVQLL.exe 892 lrPBx4qjVQLL.exe 892 lrPBx4qjVQLL.exe 892 lrPBx4qjVQLL.exe 892 lrPBx4qjVQLL.exe 892 lrPBx4qjVQLL.exe 1684 8vl94O51.exe 1684 8vl94O51.exe 1684 8vl94O51.exe 1684 8vl94O51.exe 4040 0SjSYePw.exe 4040 0SjSYePw.exe 4040 0SjSYePw.exe 4040 0SjSYePw.exe 4040 0SjSYePw.exe 4040 0SjSYePw.exe 4040 0SjSYePw.exe 4040 0SjSYePw.exe 4040 0SjSYePw.exe 4040 0SjSYePw.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
8vl94O51.exedescription pid process Token: SeDebugPrivilege 1684 8vl94O51.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
lrPBx4qjVQLL.exeInstallUtil.exe8vl94O51.exe8vl94O51.exe0SjSYePw.execmd.exedescription pid process target process PID 892 wrote to memory of 460 892 lrPBx4qjVQLL.exe InstallUtil.exe PID 892 wrote to memory of 460 892 lrPBx4qjVQLL.exe InstallUtil.exe PID 892 wrote to memory of 460 892 lrPBx4qjVQLL.exe InstallUtil.exe PID 892 wrote to memory of 460 892 lrPBx4qjVQLL.exe InstallUtil.exe PID 892 wrote to memory of 460 892 lrPBx4qjVQLL.exe InstallUtil.exe PID 460 wrote to memory of 4040 460 InstallUtil.exe 0SjSYePw.exe PID 460 wrote to memory of 4040 460 InstallUtil.exe 0SjSYePw.exe PID 460 wrote to memory of 4040 460 InstallUtil.exe 0SjSYePw.exe PID 460 wrote to memory of 1684 460 InstallUtil.exe 8vl94O51.exe PID 460 wrote to memory of 1684 460 InstallUtil.exe 8vl94O51.exe PID 460 wrote to memory of 1684 460 InstallUtil.exe 8vl94O51.exe PID 1684 wrote to memory of 228 1684 8vl94O51.exe 8vl94O51.exe PID 1684 wrote to memory of 228 1684 8vl94O51.exe 8vl94O51.exe PID 1684 wrote to memory of 228 1684 8vl94O51.exe 8vl94O51.exe PID 1684 wrote to memory of 228 1684 8vl94O51.exe 8vl94O51.exe PID 1684 wrote to memory of 228 1684 8vl94O51.exe 8vl94O51.exe PID 1684 wrote to memory of 228 1684 8vl94O51.exe 8vl94O51.exe PID 1684 wrote to memory of 228 1684 8vl94O51.exe 8vl94O51.exe PID 1684 wrote to memory of 228 1684 8vl94O51.exe 8vl94O51.exe PID 1684 wrote to memory of 228 1684 8vl94O51.exe 8vl94O51.exe PID 1684 wrote to memory of 228 1684 8vl94O51.exe 8vl94O51.exe PID 460 wrote to memory of 3244 460 InstallUtil.exe Q7j7XBa6.exe PID 460 wrote to memory of 3244 460 InstallUtil.exe Q7j7XBa6.exe PID 228 wrote to memory of 4300 228 8vl94O51.exe schtasks.exe PID 228 wrote to memory of 4300 228 8vl94O51.exe schtasks.exe PID 228 wrote to memory of 4300 228 8vl94O51.exe schtasks.exe PID 4040 wrote to memory of 820 4040 0SjSYePw.exe schtasks.exe PID 4040 wrote to memory of 820 4040 0SjSYePw.exe schtasks.exe PID 4040 wrote to memory of 820 4040 0SjSYePw.exe schtasks.exe PID 4040 wrote to memory of 3976 4040 0SjSYePw.exe DllResource.exe PID 4040 wrote to memory of 3976 4040 0SjSYePw.exe DllResource.exe PID 4040 wrote to memory of 3976 4040 0SjSYePw.exe DllResource.exe PID 4040 wrote to memory of 1324 4040 0SjSYePw.exe cmd.exe PID 4040 wrote to memory of 1324 4040 0SjSYePw.exe cmd.exe PID 4040 wrote to memory of 1324 4040 0SjSYePw.exe cmd.exe PID 1324 wrote to memory of 4560 1324 cmd.exe chcp.com PID 1324 wrote to memory of 4560 1324 cmd.exe chcp.com PID 1324 wrote to memory of 4560 1324 cmd.exe chcp.com PID 1324 wrote to memory of 4208 1324 cmd.exe PING.EXE PID 1324 wrote to memory of 4208 1324 cmd.exe PING.EXE PID 1324 wrote to memory of 4208 1324 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\lrPBx4qjVQLL.exe"C:\Users\Admin\AppData\Local\Temp\lrPBx4qjVQLL.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\0SjSYePw.exe"C:\Users\Admin\AppData\Roaming\0SjSYePw.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\TypeRes\DllResource.exe"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\TypeRes\DllResource.exe"C:\Users\Admin\TypeRes\DllResource.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Roaming\0SjSYePw.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.15⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\8vl94O51.exe"C:\Users\Admin\AppData\Roaming\8vl94O51.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\8vl94O51.exe"C:\Users\Admin\AppData\Roaming\8vl94O51.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Q7j7XBa6.exe"C:\Users\Admin\AppData\Local\Temp\Q7j7XBa6.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\mozglue.dllFilesize
612KB
MD5f07d9977430e762b563eaadc2b94bbfa
SHA1da0a05b2b8d269fb73558dfcf0ed5c167f6d3877
SHA2564191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862
SHA5126afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf
-
C:\Users\Admin\AppData\LocalLow\nss3.dllFilesize
1.9MB
MD5f67d08e8c02574cbc2f1122c53bfb976
SHA16522992957e7e4d074947cad63189f308a80fcf2
SHA256c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e
SHA5122e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5
-
C:\Users\Admin\AppData\LocalLow\sqlite3.dllFilesize
1.0MB
MD5dbf4f8dcefb8056dc6bae4b67ff810ce
SHA1bbac1dd8a07c6069415c04b62747d794736d0689
SHA25647b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68
SHA512b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1
-
C:\Users\Admin\AppData\Local\Temp\Q7j7XBa6.exeFilesize
16.6MB
MD54d12325765be0951b3d05237dd68b3f8
SHA16e3280fa3953ac2b42c9f2002b0a8188c2742f25
SHA256a8ef7985e7e029c6f66dd8571568d053c1a65b5d493553bb20fae8846a7ae2e4
SHA512d0351cc8e8875a95473cabf40e58fc1fb7ffb94ddf124fafb400e0b7dda1377a9996a7d516026b437de9e4acff869ae29252949a71dee324727c073ed651b2f1
-
C:\Users\Admin\AppData\Local\Temp\Q7j7XBa6.exeFilesize
16.6MB
MD54d12325765be0951b3d05237dd68b3f8
SHA16e3280fa3953ac2b42c9f2002b0a8188c2742f25
SHA256a8ef7985e7e029c6f66dd8571568d053c1a65b5d493553bb20fae8846a7ae2e4
SHA512d0351cc8e8875a95473cabf40e58fc1fb7ffb94ddf124fafb400e0b7dda1377a9996a7d516026b437de9e4acff869ae29252949a71dee324727c073ed651b2f1
-
C:\Users\Admin\AppData\Roaming\0SjSYePw.exeFilesize
1.9MB
MD55986aff76e7813045b1b130efbb10d30
SHA162b1f733fe7ed0c0230c20dae3c4a65ecb28e180
SHA2567dd44d3b3df4f14474d20ffa23e2fb20dcf22ed3a1458b345a1bd85563ac4a62
SHA512bfa2cad2bbbb61af7dbd22818db048ddaf68e2e22d1c55d80450a7a0c4c31c09bf596f04ebc2a7f55ac70c294ae01d3e8987af4d0bbb60c63662d21c008b3115
-
C:\Users\Admin\AppData\Roaming\0SjSYePw.exeFilesize
1.9MB
MD55986aff76e7813045b1b130efbb10d30
SHA162b1f733fe7ed0c0230c20dae3c4a65ecb28e180
SHA2567dd44d3b3df4f14474d20ffa23e2fb20dcf22ed3a1458b345a1bd85563ac4a62
SHA512bfa2cad2bbbb61af7dbd22818db048ddaf68e2e22d1c55d80450a7a0c4c31c09bf596f04ebc2a7f55ac70c294ae01d3e8987af4d0bbb60c63662d21c008b3115
-
C:\Users\Admin\AppData\Roaming\8vl94O51.exeFilesize
519KB
MD50cc25540c7ea712231dfaa165733b316
SHA12c4398ac4c7e4ea2605a7f9cd96b8c15db743e35
SHA256166af3429b6d9a81fbb537849190190516596c0c4a44be03728a408003039d82
SHA51234d25b55546e242e5940ee7c891fb37b2ad257a06b91d87e56e47385495ec45386accfb91d405cedd673b4507ede392b3533b1a218a94e90adcfcf432c697eb4
-
C:\Users\Admin\AppData\Roaming\8vl94O51.exeFilesize
519KB
MD50cc25540c7ea712231dfaa165733b316
SHA12c4398ac4c7e4ea2605a7f9cd96b8c15db743e35
SHA256166af3429b6d9a81fbb537849190190516596c0c4a44be03728a408003039d82
SHA51234d25b55546e242e5940ee7c891fb37b2ad257a06b91d87e56e47385495ec45386accfb91d405cedd673b4507ede392b3533b1a218a94e90adcfcf432c697eb4
-
C:\Users\Admin\AppData\Roaming\8vl94O51.exeFilesize
519KB
MD50cc25540c7ea712231dfaa165733b316
SHA12c4398ac4c7e4ea2605a7f9cd96b8c15db743e35
SHA256166af3429b6d9a81fbb537849190190516596c0c4a44be03728a408003039d82
SHA51234d25b55546e242e5940ee7c891fb37b2ad257a06b91d87e56e47385495ec45386accfb91d405cedd673b4507ede392b3533b1a218a94e90adcfcf432c697eb4
-
C:\Users\Admin\TypeRes\DllResource.exeFilesize
80.7MB
MD573be0b2f989f1cd0c019e98bd7d8a344
SHA1a01c75acd8ac1411bfa091a99cdd1da34a0e971d
SHA2569a195871ba95b67df4bbf17ff2c470ab62b69ad58a5cd01bc17bfaa1d907ff5c
SHA512dba44c4443baf96f8189795975fc9e619ab619ea276f63faab4cf6df2dafa79bc4c21cf813465888707d16f00243b8dca95d9356465ac4bd0bcf7f7173904174
-
C:\Users\Admin\TypeRes\DllResource.exeFilesize
83.9MB
MD5d4f0c0fae4420a6552b764357885b431
SHA195ef63c3e21af389739c8bb608bb0b4ad4343b1f
SHA256e487bd60c46dc5e65dc4d7727da0470fec73bdc6b58d0645795d1079dab7016e
SHA512e50638ed4a6624a279bafd3a0e859ce2d4a53795f5af6590bc19d913c80df964f4565587a073fa649cebd69c68281ecea2367c901e7a764397a23cb53c2eb7e9
-
memory/228-170-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/228-162-0x0000000000000000-mapping.dmp
-
memory/228-174-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/228-172-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/228-171-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/228-168-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/460-143-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/460-141-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/460-139-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/460-138-0x0000000000000000-mapping.dmp
-
memory/460-145-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/820-175-0x0000000000000000-mapping.dmp
-
memory/892-137-0x0000000010B50000-0x0000000010C16000-memory.dmpFilesize
792KB
-
memory/892-136-0x0000000010B50000-0x0000000010C16000-memory.dmpFilesize
792KB
-
memory/892-133-0x0000000002372000-0x00000000024B6000-memory.dmpFilesize
1.3MB
-
memory/892-134-0x000000000257B000-0x0000000002BE5000-memory.dmpFilesize
6.4MB
-
memory/892-144-0x0000000002372000-0x00000000024B6000-memory.dmpFilesize
1.3MB
-
memory/892-135-0x0000000002372000-0x00000000024B6000-memory.dmpFilesize
1.3MB
-
memory/892-132-0x000000000257B000-0x0000000002BE5000-memory.dmpFilesize
6.4MB
-
memory/1324-179-0x0000000000000000-mapping.dmp
-
memory/1684-153-0x0000000000000000-mapping.dmp
-
memory/1684-160-0x0000000006AC0000-0x0000000006ACA000-memory.dmpFilesize
40KB
-
memory/1684-156-0x00000000002F0000-0x0000000000374000-memory.dmpFilesize
528KB
-
memory/1684-157-0x0000000005440000-0x00000000054DC000-memory.dmpFilesize
624KB
-
memory/1684-158-0x0000000005AC0000-0x0000000006064000-memory.dmpFilesize
5.6MB
-
memory/1684-159-0x00000000055B0000-0x0000000005642000-memory.dmpFilesize
584KB
-
memory/3244-164-0x0000000000000000-mapping.dmp
-
memory/3976-176-0x0000000000000000-mapping.dmp
-
memory/3976-183-0x000000000245E000-0x0000000002BEE000-memory.dmpFilesize
7.6MB
-
memory/4040-152-0x00000000022E0000-0x0000000002A70000-memory.dmpFilesize
7.6MB
-
memory/4040-149-0x0000000000000000-mapping.dmp
-
memory/4040-163-0x00000000022E0000-0x0000000002A70000-memory.dmpFilesize
7.6MB
-
memory/4040-161-0x0000000002A85000-0x0000000002C04000-memory.dmpFilesize
1.5MB
-
memory/4040-167-0x0000000002A85000-0x0000000002C04000-memory.dmpFilesize
1.5MB
-
memory/4040-180-0x0000000002A85000-0x0000000002C04000-memory.dmpFilesize
1.5MB
-
memory/4208-182-0x0000000000000000-mapping.dmp
-
memory/4300-173-0x0000000000000000-mapping.dmp
-
memory/4560-181-0x0000000000000000-mapping.dmp