Analysis
-
max time kernel
72s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-09-2022 20:33
Behavioral task
behavioral1
Sample
IPPMKEK.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
General
-
Target
IPPMKEK.exe
-
Size
4.1MB
-
MD5
82c470c652ce1f039edb6486f878f766
-
SHA1
425a90761731d3d4867a0e4628d46cf1c4856f44
-
SHA256
792d8bfb5e0660c8967fa84902963bbd3ccc345f9e17f777c6d016343655afdf
-
SHA512
bee0e81e11f8a4457b89dee54a26ff8148e520d7049df77d0a2705bb92402f3f6814b1e103dc17a267ee7874821f4ed0567e2aa50841247748cc534a57bde92a
-
SSDEEP
98304:8HswGIPlWbxvQ04sgyZ6L1ympDF73twzC/:8bL4ldgyZqI8DF7MC/
Malware Config
Extracted
Family
raccoon
Botnet
9b19cf60d9bdf65b8a2495aa965456c3
C2
http://94.131.107.206
rc4.plain
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
IPPMKEK.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ IPPMKEK.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
IPPMKEK.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion IPPMKEK.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion IPPMKEK.exe -
Processes:
resource yara_rule behavioral2/memory/3516-136-0x0000000000B50000-0x0000000000F74000-memory.dmp themida behavioral2/memory/3516-137-0x0000000000B50000-0x0000000000F74000-memory.dmp themida -
Processes:
IPPMKEK.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IPPMKEK.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
IPPMKEK.exedescription pid process target process PID 3516 set thread context of 2268 3516 IPPMKEK.exe MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
IPPMKEK.exedescription pid process Token: SeDebugPrivilege 3516 IPPMKEK.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
IPPMKEK.exedescription pid process target process PID 3516 wrote to memory of 2268 3516 IPPMKEK.exe MSBuild.exe PID 3516 wrote to memory of 2268 3516 IPPMKEK.exe MSBuild.exe PID 3516 wrote to memory of 2268 3516 IPPMKEK.exe MSBuild.exe PID 3516 wrote to memory of 2268 3516 IPPMKEK.exe MSBuild.exe PID 3516 wrote to memory of 2268 3516 IPPMKEK.exe MSBuild.exe PID 3516 wrote to memory of 2268 3516 IPPMKEK.exe MSBuild.exe PID 3516 wrote to memory of 2268 3516 IPPMKEK.exe MSBuild.exe PID 3516 wrote to memory of 2268 3516 IPPMKEK.exe MSBuild.exe PID 3516 wrote to memory of 2268 3516 IPPMKEK.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IPPMKEK.exe"C:\Users\Admin\AppData\Local\Temp\IPPMKEK.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2268-142-0x0000000000000000-mapping.dmp
-
memory/2268-143-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2268-145-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2268-146-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3516-135-0x0000000000B50000-0x0000000000F74000-memory.dmpFilesize
4.1MB
-
memory/3516-136-0x0000000000B50000-0x0000000000F74000-memory.dmpFilesize
4.1MB
-
memory/3516-137-0x0000000000B50000-0x0000000000F74000-memory.dmpFilesize
4.1MB
-
memory/3516-138-0x0000000005480000-0x0000000005A24000-memory.dmpFilesize
5.6MB
-
memory/3516-139-0x0000000004F70000-0x0000000005002000-memory.dmpFilesize
584KB
-
memory/3516-140-0x0000000004F00000-0x0000000004F0A000-memory.dmpFilesize
40KB
-
memory/3516-141-0x0000000006510000-0x00000000065AC000-memory.dmpFilesize
624KB
-
memory/3516-147-0x0000000000B50000-0x0000000000F74000-memory.dmpFilesize
4.1MB