Analysis
-
max time kernel
86s -
max time network
76s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-09-2022 17:38
Static task
static1
Behavioral task
behavioral1
Sample
KJLKDOX.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
KJLKDOX.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
KJLKDOX.exe
-
Size
3.9MB
-
MD5
64b30e9465580bc5af03f01e930e04b3
-
SHA1
727f463e282cc19e4a55b96dd05c60d4bc8b460a
-
SHA256
5a3544515807da069035c75e37e1570b893768eeab16385402b0464fd26272c0
-
SHA512
d846ba776ff4ccfea1ab9f812266736d814b158731a0ec6e542c9d791d43714ff376f0746aad9257a60bc68b8b4a33f204763b5ba8cd5d4d988af504c9cea81c
-
SSDEEP
98304:6PgeUa+s1ybDLoAu4xe8qm8jttGnwSYWqwO0+ny+UEq:6PcQynL3uuq3RtGCwO0wysq
Score
10/10
Malware Config
Extracted
Family
raccoon
Botnet
9b19cf60d9bdf65b8a2495aa965456c3
C2
http://94.131.107.206
rc4.plain
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
KJLKDOX.exedescription pid process target process PID 1112 set thread context of 1032 1112 KJLKDOX.exe jsc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
KJLKDOX.exedescription pid process Token: SeDebugPrivilege 1112 KJLKDOX.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
KJLKDOX.exedescription pid process target process PID 1112 wrote to memory of 1032 1112 KJLKDOX.exe jsc.exe PID 1112 wrote to memory of 1032 1112 KJLKDOX.exe jsc.exe PID 1112 wrote to memory of 1032 1112 KJLKDOX.exe jsc.exe PID 1112 wrote to memory of 1032 1112 KJLKDOX.exe jsc.exe PID 1112 wrote to memory of 1032 1112 KJLKDOX.exe jsc.exe PID 1112 wrote to memory of 1032 1112 KJLKDOX.exe jsc.exe PID 1112 wrote to memory of 1032 1112 KJLKDOX.exe jsc.exe PID 1112 wrote to memory of 1032 1112 KJLKDOX.exe jsc.exe PID 1112 wrote to memory of 1032 1112 KJLKDOX.exe jsc.exe PID 1112 wrote to memory of 1032 1112 KJLKDOX.exe jsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\KJLKDOX.exe"C:\Users\Admin\AppData\Local\Temp\KJLKDOX.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\jsc.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1032-56-0x0000000000080000-0x0000000000094000-memory.dmpFilesize
80KB
-
memory/1032-57-0x0000000000080000-0x0000000000094000-memory.dmpFilesize
80KB
-
memory/1032-59-0x0000000000080000-0x0000000000094000-memory.dmpFilesize
80KB
-
memory/1032-61-0x0000000000080000-0x0000000000094000-memory.dmpFilesize
80KB
-
memory/1032-62-0x0000000000080000-0x0000000000094000-memory.dmpFilesize
80KB
-
memory/1032-65-0x0000000000408597-mapping.dmp
-
memory/1032-66-0x0000000000080000-0x0000000000094000-memory.dmpFilesize
80KB
-
memory/1032-70-0x0000000000080000-0x0000000000094000-memory.dmpFilesize
80KB
-
memory/1032-74-0x0000000000080000-0x0000000000094000-memory.dmpFilesize
80KB
-
memory/1032-75-0x0000000074D61000-0x0000000074D63000-memory.dmpFilesize
8KB
-
memory/1112-54-0x00000000012B0000-0x00000000016A6000-memory.dmpFilesize
4.0MB
-
memory/1112-55-0x0000000000C10000-0x0000000000C76000-memory.dmpFilesize
408KB