Analysis
-
max time kernel
91s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
19-10-2022 20:50
Static task
static1
Behavioral task
behavioral1
Sample
df7cfb28f642a2341b0cf3d5626ec787a7afb0aacd3e6806b7a0caa3a6dd73ee.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
df7cfb28f642a2341b0cf3d5626ec787a7afb0aacd3e6806b7a0caa3a6dd73ee.exe
Resource
win10v2004-20220901-en
General
-
Target
df7cfb28f642a2341b0cf3d5626ec787a7afb0aacd3e6806b7a0caa3a6dd73ee.exe
-
Size
1.6MB
-
MD5
4bad8e019dc6d8254185426c2fef0c59
-
SHA1
7b55fcbae0b8c90100a0b8b999292e1c83ab5947
-
SHA256
df7cfb28f642a2341b0cf3d5626ec787a7afb0aacd3e6806b7a0caa3a6dd73ee
-
SHA512
c8b82b65ed3eb15fc208147587ea5051dde079eba9006fad751195d2004398c4bd2eed0e1b1aab6cd01a3526eb04b30eb4b0798e6e68f5019c0d4faf155bbf96
-
SSDEEP
49152:Tm5PrbWIRjUx3FEcLhbu32hEwdGvmKdAzDJ6SM:Tm5j0icVY2hNdGuKdAc
Malware Config
Extracted
raccoon
9b19cf60d9bdf65b8a2495aa965456c3
http://5.2.70.65/
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
df7cfb28f642a2341b0cf3d5626ec787a7afb0aacd3e6806b7a0caa3a6dd73ee.exedescription pid process target process PID 2236 set thread context of 2860 2236 df7cfb28f642a2341b0cf3d5626ec787a7afb0aacd3e6806b7a0caa3a6dd73ee.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
df7cfb28f642a2341b0cf3d5626ec787a7afb0aacd3e6806b7a0caa3a6dd73ee.exepid process 2236 df7cfb28f642a2341b0cf3d5626ec787a7afb0aacd3e6806b7a0caa3a6dd73ee.exe 2236 df7cfb28f642a2341b0cf3d5626ec787a7afb0aacd3e6806b7a0caa3a6dd73ee.exe 2236 df7cfb28f642a2341b0cf3d5626ec787a7afb0aacd3e6806b7a0caa3a6dd73ee.exe 2236 df7cfb28f642a2341b0cf3d5626ec787a7afb0aacd3e6806b7a0caa3a6dd73ee.exe 2236 df7cfb28f642a2341b0cf3d5626ec787a7afb0aacd3e6806b7a0caa3a6dd73ee.exe 2236 df7cfb28f642a2341b0cf3d5626ec787a7afb0aacd3e6806b7a0caa3a6dd73ee.exe 2236 df7cfb28f642a2341b0cf3d5626ec787a7afb0aacd3e6806b7a0caa3a6dd73ee.exe 2236 df7cfb28f642a2341b0cf3d5626ec787a7afb0aacd3e6806b7a0caa3a6dd73ee.exe 2236 df7cfb28f642a2341b0cf3d5626ec787a7afb0aacd3e6806b7a0caa3a6dd73ee.exe 2236 df7cfb28f642a2341b0cf3d5626ec787a7afb0aacd3e6806b7a0caa3a6dd73ee.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
df7cfb28f642a2341b0cf3d5626ec787a7afb0aacd3e6806b7a0caa3a6dd73ee.exedescription pid process target process PID 2236 wrote to memory of 2860 2236 df7cfb28f642a2341b0cf3d5626ec787a7afb0aacd3e6806b7a0caa3a6dd73ee.exe InstallUtil.exe PID 2236 wrote to memory of 2860 2236 df7cfb28f642a2341b0cf3d5626ec787a7afb0aacd3e6806b7a0caa3a6dd73ee.exe InstallUtil.exe PID 2236 wrote to memory of 2860 2236 df7cfb28f642a2341b0cf3d5626ec787a7afb0aacd3e6806b7a0caa3a6dd73ee.exe InstallUtil.exe PID 2236 wrote to memory of 2860 2236 df7cfb28f642a2341b0cf3d5626ec787a7afb0aacd3e6806b7a0caa3a6dd73ee.exe InstallUtil.exe PID 2236 wrote to memory of 2860 2236 df7cfb28f642a2341b0cf3d5626ec787a7afb0aacd3e6806b7a0caa3a6dd73ee.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df7cfb28f642a2341b0cf3d5626ec787a7afb0aacd3e6806b7a0caa3a6dd73ee.exe"C:\Users\Admin\AppData\Local\Temp\df7cfb28f642a2341b0cf3d5626ec787a7afb0aacd3e6806b7a0caa3a6dd73ee.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2236-132-0x0000000002396000-0x0000000002AE0000-memory.dmpFilesize
7.3MB
-
memory/2236-133-0x0000000002AFA000-0x0000000002C6B000-memory.dmpFilesize
1.4MB
-
memory/2236-134-0x0000000002396000-0x0000000002AE0000-memory.dmpFilesize
7.3MB
-
memory/2236-135-0x0000000002AFA000-0x0000000002C6B000-memory.dmpFilesize
1.4MB
-
memory/2236-136-0x000000000CB60000-0x000000000CC50000-memory.dmpFilesize
960KB
-
memory/2236-137-0x000000000CB60000-0x000000000CC50000-memory.dmpFilesize
960KB
-
memory/2236-144-0x0000000002AFA000-0x0000000002C6B000-memory.dmpFilesize
1.4MB
-
memory/2860-138-0x0000000000000000-mapping.dmp
-
memory/2860-139-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2860-141-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2860-143-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2860-145-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB