Analysis
- max time kernel
159s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
08/10/2022, 07:51
General
- Target f9d49869c91024c5a3dd399248908e56.exe
- Size 295KB
- Sample221008-jptrxaeedp
- SHA256 177fbd109bb143efcbddb2ff8fe7cc5d4af6931b5e98b23266e4e9031ef750f0
Malware Config
Extracted
-
raccoon
-
9333547b6d5c69ea798fd93c66d78435
-
http://45.15.156.27
Extracted
-
raccoon
-
17aad1e8aa2ca5164d7690cff1926390
-
http://45.15.156.27
Signatures
- Detects Smokeloader packer 2 IoCs
- Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 4 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 19 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of WriteProcessMemory 57 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9d49869c91024c5a3dd399248908e56.exe"C:\Users\Admin\AppData\Local\Temp\f9d49869c91024c5a3dd399248908e56.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\181C.exeC:\Users\Admin\AppData\Local\Temp\181C.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\181C.exeC:\Users\Admin\AppData\Local\Temp\181C.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\22CB.exeC:\Users\Admin\AppData\Local\Temp\22CB.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\22CB.exeC:\Users\Admin\AppData\Local\Temp\22CB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
181C.exe
181C.exe
181C.exe
22CB.exe
22CB.exe
22CB.exe
memory/1272-194-0x0000000000E00000-0x0000000000E07000-memory.dmp
memory/1272-183-0x0000000000BF0000-0x0000000000BFD000-memory.dmp
memory/1272-182-0x0000000000E00000-0x0000000000E07000-memory.dmp
memory/2236-174-0x0000000000600000-0x0000000000627000-memory.dmp
memory/2236-173-0x0000000000A80000-0x0000000000AA2000-memory.dmp
memory/2236-191-0x0000000000A80000-0x0000000000AA2000-memory.dmp
memory/2300-159-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2300-158-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2300-155-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2400-164-0x0000000000E90000-0x0000000000E99000-memory.dmp
memory/2400-188-0x0000000000E90000-0x0000000000E99000-memory.dmp
memory/2400-165-0x0000000000E80000-0x0000000000E8F000-memory.dmp
memory/3556-146-0x0000000000400000-0x0000000000414000-memory.dmp
memory/3556-145-0x0000000000400000-0x0000000000414000-memory.dmp
memory/3556-142-0x0000000000400000-0x0000000000414000-memory.dmp
memory/3564-139-0x0000000000F00000-0x00000000010A8000-memory.dmp
memory/3564-140-0x0000000006570000-0x0000000006592000-memory.dmp
memory/3672-133-0x0000000000510000-0x0000000000519000-memory.dmp
memory/3672-135-0x0000000000400000-0x0000000000495000-memory.dmp
memory/3672-134-0x0000000000400000-0x0000000000495000-memory.dmp
memory/3672-132-0x000000000057D000-0x000000000058E000-memory.dmp
memory/3812-179-0x0000000000600000-0x0000000000606000-memory.dmp
memory/3812-193-0x0000000000600000-0x0000000000606000-memory.dmp
memory/3812-180-0x00000000005F0000-0x00000000005FB000-memory.dmp
memory/4064-192-0x0000000000610000-0x0000000000615000-memory.dmp
memory/4064-176-0x0000000000610000-0x0000000000615000-memory.dmp
memory/4064-177-0x0000000000600000-0x0000000000609000-memory.dmp
memory/4472-186-0x0000000000E90000-0x0000000000E9B000-memory.dmp
memory/4472-185-0x0000000000EA0000-0x0000000000EA8000-memory.dmp
memory/4472-195-0x0000000000EA0000-0x0000000000EA8000-memory.dmp
memory/4640-153-0x00000000052D0000-0x00000000052DA000-memory.dmp
memory/4640-150-0x0000000000730000-0x00000000008C8000-memory.dmp
memory/4640-152-0x0000000005130000-0x00000000051C2000-memory.dmp
memory/4640-151-0x0000000005600000-0x0000000005BA4000-memory.dmp
memory/4660-162-0x0000000000EC0000-0x0000000000ECB000-memory.dmp
memory/4660-161-0x0000000000ED0000-0x0000000000ED7000-memory.dmp
memory/4660-187-0x0000000000ED0000-0x0000000000ED7000-memory.dmp
memory/4776-189-0x0000000000EE0000-0x0000000000EE5000-memory.dmp
memory/4776-168-0x0000000000ED0000-0x0000000000ED9000-memory.dmp
memory/4776-167-0x0000000000EE0000-0x0000000000EE5000-memory.dmp
memory/4904-190-0x0000000000F60000-0x0000000000F66000-memory.dmp
memory/4904-170-0x0000000000F60000-0x0000000000F66000-memory.dmp
memory/4904-171-0x0000000000F50000-0x0000000000F5C000-memory.dmp