Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-09-2022 05:48
Static task
static1
Behavioral task
behavioral1
Sample
0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe
Resource
win10v2004-20220901-en
General
-
Target
0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe
-
Size
1013KB
-
MD5
20b4ed91510de8b2766a7b27b643a007
-
SHA1
e52812e0a3a17a291f524bde23a7dea44339bbf3
-
SHA256
0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a
-
SHA512
bad5c56aeb9b57c7b4591f34f41a157fc60e5038eeef82aaaa297a267bfb6c69ad8d52a9b60142c502756f56829c8a44840c620e1191458135fbb5b319feed0f
-
SSDEEP
24576:/axyj3UlpY02W9pNydU50sTmJf2fU+NAmAOLm+t:/ac3UoW9OGxTmJ6emACm+
Malware Config
Extracted
raccoon
1.7.1-hotfix
1cc7ea34e0c2ffcad2b614bf34887c32c8a79609
-
url4cnc
https://telete.in/brikitiki
Extracted
oski
darkangel.ac.ug
Extracted
azorult
http://195.245.112.115/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Raccoon Stealer payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1320-84-0x0000000000400000-0x0000000000493000-memory.dmp family_raccoon -
Executes dropped EXE 4 IoCs
Processes:
HJsdfccdf.exeYTfghawe.exeYTfghawe.exeHJsdfccdf.exepid process 1724 HJsdfccdf.exe 1444 YTfghawe.exe 1144 YTfghawe.exe 1780 HJsdfccdf.exe -
Loads dropped DLL 11 IoCs
Processes:
0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exeYTfghawe.exeHJsdfccdf.exeWerFault.exepid process 1964 0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe 1964 0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe 1964 0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe 1964 0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe 1444 YTfghawe.exe 1724 HJsdfccdf.exe 1156 WerFault.exe 1156 WerFault.exe 1156 WerFault.exe 1156 WerFault.exe 1156 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exeYTfghawe.exeHJsdfccdf.exedescription pid process target process PID 1964 set thread context of 1320 1964 0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe 0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe PID 1444 set thread context of 1144 1444 YTfghawe.exe YTfghawe.exe PID 1724 set thread context of 1780 1724 HJsdfccdf.exe HJsdfccdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1156 1144 WerFault.exe YTfghawe.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exeYTfghawe.exeHJsdfccdf.exepid process 1964 0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe 1444 YTfghawe.exe 1724 HJsdfccdf.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exeYTfghawe.exeHJsdfccdf.exepid process 1964 0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe 1444 YTfghawe.exe 1724 HJsdfccdf.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exeYTfghawe.exeHJsdfccdf.exeYTfghawe.exedescription pid process target process PID 1964 wrote to memory of 1724 1964 0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe HJsdfccdf.exe PID 1964 wrote to memory of 1724 1964 0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe HJsdfccdf.exe PID 1964 wrote to memory of 1724 1964 0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe HJsdfccdf.exe PID 1964 wrote to memory of 1724 1964 0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe HJsdfccdf.exe PID 1964 wrote to memory of 1444 1964 0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe YTfghawe.exe PID 1964 wrote to memory of 1444 1964 0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe YTfghawe.exe PID 1964 wrote to memory of 1444 1964 0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe YTfghawe.exe PID 1964 wrote to memory of 1444 1964 0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe YTfghawe.exe PID 1964 wrote to memory of 1320 1964 0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe 0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe PID 1964 wrote to memory of 1320 1964 0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe 0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe PID 1964 wrote to memory of 1320 1964 0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe 0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe PID 1964 wrote to memory of 1320 1964 0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe 0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe PID 1964 wrote to memory of 1320 1964 0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe 0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe PID 1444 wrote to memory of 1144 1444 YTfghawe.exe YTfghawe.exe PID 1444 wrote to memory of 1144 1444 YTfghawe.exe YTfghawe.exe PID 1444 wrote to memory of 1144 1444 YTfghawe.exe YTfghawe.exe PID 1444 wrote to memory of 1144 1444 YTfghawe.exe YTfghawe.exe PID 1444 wrote to memory of 1144 1444 YTfghawe.exe YTfghawe.exe PID 1724 wrote to memory of 1780 1724 HJsdfccdf.exe HJsdfccdf.exe PID 1724 wrote to memory of 1780 1724 HJsdfccdf.exe HJsdfccdf.exe PID 1724 wrote to memory of 1780 1724 HJsdfccdf.exe HJsdfccdf.exe PID 1724 wrote to memory of 1780 1724 HJsdfccdf.exe HJsdfccdf.exe PID 1724 wrote to memory of 1780 1724 HJsdfccdf.exe HJsdfccdf.exe PID 1144 wrote to memory of 1156 1144 YTfghawe.exe WerFault.exe PID 1144 wrote to memory of 1156 1144 YTfghawe.exe WerFault.exe PID 1144 wrote to memory of 1156 1144 YTfghawe.exe WerFault.exe PID 1144 wrote to memory of 1156 1144 YTfghawe.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe"C:\Users\Admin\AppData\Local\Temp\0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\HJsdfccdf.exe"C:\Users\Admin\AppData\Local\Temp\HJsdfccdf.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\HJsdfccdf.exe"C:\Users\Admin\AppData\Local\Temp\HJsdfccdf.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\YTfghawe.exe"C:\Users\Admin\AppData\Local\Temp\YTfghawe.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\YTfghawe.exe"C:\Users\Admin\AppData\Local\Temp\YTfghawe.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 8484⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe"C:\Users\Admin\AppData\Local\Temp\0733d640a833a24e6c37c8085a6e22ba3245eee995c83edf79f20efa327d365a.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HJsdfccdf.exeFilesize
213KB
MD5a22b4c1514f696b13a2862aea769ba6a
SHA1a554a8e63f5d05b880e416a9d0999d628d033f03
SHA256fe2a8feb0ecd163115d28be80cf4212321de4bd03c7f88e611fbdf8a6551ba2f
SHA512fd4fb44e03f0239abb30ca50fbb63db250c28d52a68f108ce5b7e95d1bbf6c84cd07229e3fa3b568ca6a805f6d19ba591b98b12c72aeac59893d826a029bdc60
-
C:\Users\Admin\AppData\Local\Temp\HJsdfccdf.exeFilesize
213KB
MD5a22b4c1514f696b13a2862aea769ba6a
SHA1a554a8e63f5d05b880e416a9d0999d628d033f03
SHA256fe2a8feb0ecd163115d28be80cf4212321de4bd03c7f88e611fbdf8a6551ba2f
SHA512fd4fb44e03f0239abb30ca50fbb63db250c28d52a68f108ce5b7e95d1bbf6c84cd07229e3fa3b568ca6a805f6d19ba591b98b12c72aeac59893d826a029bdc60
-
C:\Users\Admin\AppData\Local\Temp\HJsdfccdf.exeFilesize
213KB
MD5a22b4c1514f696b13a2862aea769ba6a
SHA1a554a8e63f5d05b880e416a9d0999d628d033f03
SHA256fe2a8feb0ecd163115d28be80cf4212321de4bd03c7f88e611fbdf8a6551ba2f
SHA512fd4fb44e03f0239abb30ca50fbb63db250c28d52a68f108ce5b7e95d1bbf6c84cd07229e3fa3b568ca6a805f6d19ba591b98b12c72aeac59893d826a029bdc60
-
C:\Users\Admin\AppData\Local\Temp\YTfghawe.exeFilesize
261KB
MD5ba2af377d1a970e8e083e4c4cec745e2
SHA1a3d2ca408a97ddca60f581cba48d3f5e74a4fb17
SHA256f58f96fb0e09e7ddc4a37caa32783b675222b4b97cd08008eaa8538bacc8d035
SHA512eb854f2ee870162f39cd1678e2f88cd99dadf0e281237a66a14be6b75be489593236d6aabfa69df76b1a31a5cf1e4ef77a913e06bdd022fc957c850d26a65e06
-
C:\Users\Admin\AppData\Local\Temp\YTfghawe.exeFilesize
261KB
MD5ba2af377d1a970e8e083e4c4cec745e2
SHA1a3d2ca408a97ddca60f581cba48d3f5e74a4fb17
SHA256f58f96fb0e09e7ddc4a37caa32783b675222b4b97cd08008eaa8538bacc8d035
SHA512eb854f2ee870162f39cd1678e2f88cd99dadf0e281237a66a14be6b75be489593236d6aabfa69df76b1a31a5cf1e4ef77a913e06bdd022fc957c850d26a65e06
-
C:\Users\Admin\AppData\Local\Temp\YTfghawe.exeFilesize
261KB
MD5ba2af377d1a970e8e083e4c4cec745e2
SHA1a3d2ca408a97ddca60f581cba48d3f5e74a4fb17
SHA256f58f96fb0e09e7ddc4a37caa32783b675222b4b97cd08008eaa8538bacc8d035
SHA512eb854f2ee870162f39cd1678e2f88cd99dadf0e281237a66a14be6b75be489593236d6aabfa69df76b1a31a5cf1e4ef77a913e06bdd022fc957c850d26a65e06
-
\Users\Admin\AppData\Local\Temp\HJsdfccdf.exeFilesize
213KB
MD5a22b4c1514f696b13a2862aea769ba6a
SHA1a554a8e63f5d05b880e416a9d0999d628d033f03
SHA256fe2a8feb0ecd163115d28be80cf4212321de4bd03c7f88e611fbdf8a6551ba2f
SHA512fd4fb44e03f0239abb30ca50fbb63db250c28d52a68f108ce5b7e95d1bbf6c84cd07229e3fa3b568ca6a805f6d19ba591b98b12c72aeac59893d826a029bdc60
-
\Users\Admin\AppData\Local\Temp\HJsdfccdf.exeFilesize
213KB
MD5a22b4c1514f696b13a2862aea769ba6a
SHA1a554a8e63f5d05b880e416a9d0999d628d033f03
SHA256fe2a8feb0ecd163115d28be80cf4212321de4bd03c7f88e611fbdf8a6551ba2f
SHA512fd4fb44e03f0239abb30ca50fbb63db250c28d52a68f108ce5b7e95d1bbf6c84cd07229e3fa3b568ca6a805f6d19ba591b98b12c72aeac59893d826a029bdc60
-
\Users\Admin\AppData\Local\Temp\HJsdfccdf.exeFilesize
213KB
MD5a22b4c1514f696b13a2862aea769ba6a
SHA1a554a8e63f5d05b880e416a9d0999d628d033f03
SHA256fe2a8feb0ecd163115d28be80cf4212321de4bd03c7f88e611fbdf8a6551ba2f
SHA512fd4fb44e03f0239abb30ca50fbb63db250c28d52a68f108ce5b7e95d1bbf6c84cd07229e3fa3b568ca6a805f6d19ba591b98b12c72aeac59893d826a029bdc60
-
\Users\Admin\AppData\Local\Temp\YTfghawe.exeFilesize
261KB
MD5ba2af377d1a970e8e083e4c4cec745e2
SHA1a3d2ca408a97ddca60f581cba48d3f5e74a4fb17
SHA256f58f96fb0e09e7ddc4a37caa32783b675222b4b97cd08008eaa8538bacc8d035
SHA512eb854f2ee870162f39cd1678e2f88cd99dadf0e281237a66a14be6b75be489593236d6aabfa69df76b1a31a5cf1e4ef77a913e06bdd022fc957c850d26a65e06
-
\Users\Admin\AppData\Local\Temp\YTfghawe.exeFilesize
261KB
MD5ba2af377d1a970e8e083e4c4cec745e2
SHA1a3d2ca408a97ddca60f581cba48d3f5e74a4fb17
SHA256f58f96fb0e09e7ddc4a37caa32783b675222b4b97cd08008eaa8538bacc8d035
SHA512eb854f2ee870162f39cd1678e2f88cd99dadf0e281237a66a14be6b75be489593236d6aabfa69df76b1a31a5cf1e4ef77a913e06bdd022fc957c850d26a65e06
-
\Users\Admin\AppData\Local\Temp\YTfghawe.exeFilesize
261KB
MD5ba2af377d1a970e8e083e4c4cec745e2
SHA1a3d2ca408a97ddca60f581cba48d3f5e74a4fb17
SHA256f58f96fb0e09e7ddc4a37caa32783b675222b4b97cd08008eaa8538bacc8d035
SHA512eb854f2ee870162f39cd1678e2f88cd99dadf0e281237a66a14be6b75be489593236d6aabfa69df76b1a31a5cf1e4ef77a913e06bdd022fc957c850d26a65e06
-
\Users\Admin\AppData\Local\Temp\YTfghawe.exeFilesize
261KB
MD5ba2af377d1a970e8e083e4c4cec745e2
SHA1a3d2ca408a97ddca60f581cba48d3f5e74a4fb17
SHA256f58f96fb0e09e7ddc4a37caa32783b675222b4b97cd08008eaa8538bacc8d035
SHA512eb854f2ee870162f39cd1678e2f88cd99dadf0e281237a66a14be6b75be489593236d6aabfa69df76b1a31a5cf1e4ef77a913e06bdd022fc957c850d26a65e06
-
\Users\Admin\AppData\Local\Temp\YTfghawe.exeFilesize
261KB
MD5ba2af377d1a970e8e083e4c4cec745e2
SHA1a3d2ca408a97ddca60f581cba48d3f5e74a4fb17
SHA256f58f96fb0e09e7ddc4a37caa32783b675222b4b97cd08008eaa8538bacc8d035
SHA512eb854f2ee870162f39cd1678e2f88cd99dadf0e281237a66a14be6b75be489593236d6aabfa69df76b1a31a5cf1e4ef77a913e06bdd022fc957c850d26a65e06
-
\Users\Admin\AppData\Local\Temp\YTfghawe.exeFilesize
261KB
MD5ba2af377d1a970e8e083e4c4cec745e2
SHA1a3d2ca408a97ddca60f581cba48d3f5e74a4fb17
SHA256f58f96fb0e09e7ddc4a37caa32783b675222b4b97cd08008eaa8538bacc8d035
SHA512eb854f2ee870162f39cd1678e2f88cd99dadf0e281237a66a14be6b75be489593236d6aabfa69df76b1a31a5cf1e4ef77a913e06bdd022fc957c850d26a65e06
-
\Users\Admin\AppData\Local\Temp\YTfghawe.exeFilesize
261KB
MD5ba2af377d1a970e8e083e4c4cec745e2
SHA1a3d2ca408a97ddca60f581cba48d3f5e74a4fb17
SHA256f58f96fb0e09e7ddc4a37caa32783b675222b4b97cd08008eaa8538bacc8d035
SHA512eb854f2ee870162f39cd1678e2f88cd99dadf0e281237a66a14be6b75be489593236d6aabfa69df76b1a31a5cf1e4ef77a913e06bdd022fc957c850d26a65e06
-
\Users\Admin\AppData\Local\Temp\YTfghawe.exeFilesize
261KB
MD5ba2af377d1a970e8e083e4c4cec745e2
SHA1a3d2ca408a97ddca60f581cba48d3f5e74a4fb17
SHA256f58f96fb0e09e7ddc4a37caa32783b675222b4b97cd08008eaa8538bacc8d035
SHA512eb854f2ee870162f39cd1678e2f88cd99dadf0e281237a66a14be6b75be489593236d6aabfa69df76b1a31a5cf1e4ef77a913e06bdd022fc957c850d26a65e06
-
memory/1144-85-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1144-76-0x0000000000417A8B-mapping.dmp
-
memory/1156-88-0x0000000000000000-mapping.dmp
-
memory/1320-84-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/1320-69-0x000000000043FA56-mapping.dmp
-
memory/1444-63-0x0000000000000000-mapping.dmp
-
memory/1724-59-0x0000000000000000-mapping.dmp
-
memory/1780-86-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1780-87-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1780-81-0x000000000041A684-mapping.dmp
-
memory/1964-56-0x0000000076411000-0x0000000076413000-memory.dmpFilesize
8KB
-
memory/1964-70-0x00000000026E0000-0x00000000026E7000-memory.dmpFilesize
28KB