Analysis

  • max time kernel
    124s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/01/2023, 17:11

General

  • Target

    infected/Installer.exe

  • Size

    677.9MB

  • MD5

    3709aaf7e625bfd4dfef3ceba18ccc4a

  • SHA1

    17fcf830d2cf2c4a016fb438cae8bf065cc55b24

  • SHA256

    9440450e86e40c1116742e77b3e97ddb5c4d4d149d9c36d0e1e5c156ddb85cd1

  • SHA512

    4ea3c2ef3226b7ed9adb966708b70dd79d6295ea603a23f34b6cada7346ce08bb2f95b2ff686ee922060ab387c5a22b34ee082d23f1d69ccf3fc46036c04c000

  • SSDEEP

    3072:gahKyd2n31z5vWp1icKAArDZz4N9GhbkENEkYg6Au/TXlbodEgY:gahOCp0yN90vEXgMrXleEd

Malware Config

Extracted

Family

purecrypter

C2

https://falcaoliderfm.com.br/wp-admin/images/css/cover/bo/Jvizg.dll

Extracted

Family

raccoon

Botnet

8f25ed0aa267992c7856160c3951e20b

C2

http://77.73.133.23/

rc4.plain

Signatures

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\infected\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\infected\Installer.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4460
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dienetwoov.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dienetwoov.exe
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:364
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA3AA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1180
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1020
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:372
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dienetwoov.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dienetwoov.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5032

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\mozglue.dll

          Filesize

          612KB

          MD5

          f07d9977430e762b563eaadc2b94bbfa

          SHA1

          da0a05b2b8d269fb73558dfcf0ed5c167f6d3877

          SHA256

          4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862

          SHA512

          6afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf

        • C:\Users\Admin\AppData\LocalLow\nss3.dll

          Filesize

          1.9MB

          MD5

          f67d08e8c02574cbc2f1122c53bfb976

          SHA1

          6522992957e7e4d074947cad63189f308a80fcf2

          SHA256

          c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e

          SHA512

          2e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5

        • C:\Users\Admin\AppData\LocalLow\sqlite3.dll

          Filesize

          1.0MB

          MD5

          dbf4f8dcefb8056dc6bae4b67ff810ce

          SHA1

          bbac1dd8a07c6069415c04b62747d794736d0689

          SHA256

          47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68

          SHA512

          b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

          Filesize

          1KB

          MD5

          4280e36a29fa31c01e4d8b2ba726a0d8

          SHA1

          c485c2c9ce0a99747b18d899b71dfa9a64dabe32

          SHA256

          e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

          SHA512

          494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

          Filesize

          53KB

          MD5

          06ad34f9739c5159b4d92d702545bd49

          SHA1

          9152a0d4f153f3f40f7e606be75f81b582ee0c17

          SHA256

          474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

          SHA512

          c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          16KB

          MD5

          8ad6260b5656f92436334157a2a08961

          SHA1

          d1fe686740e0b72d1cfb956673c7293fba05869a

          SHA256

          9c475d6c0f06a27bff2ebf8b3749a4135ae52bf9259029c16c4d3668232bfd80

          SHA512

          65ec7c87e1e9636e7a27a9ba51b6ce3b6b92e4245a2ef504c895818f29cb9486c0f43cb52750c692e17eda6205058cc29eb2d5de742b203b710fdee19d61ae45

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dienetwoov.exe

          Filesize

          391.0MB

          MD5

          d57db4d9896f6a1b0f72e4503ba94ed0

          SHA1

          e4dc13b4c7ee490bd268e2241f8812cb3e3d5744

          SHA256

          6a320e135997a07575d8433261146653b3b5c6dd71195ba5e0f892d20a85a09d

          SHA512

          ad99c68a7c31df3d26f195e758e76aed1a4a00f4ef4ad25af5812e3be27940a3002428ec21121be54e47f13ec3145b5c46568e83ff98898f8a52aef8884bea52

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dienetwoov.exe

          Filesize

          391.0MB

          MD5

          d57db4d9896f6a1b0f72e4503ba94ed0

          SHA1

          e4dc13b4c7ee490bd268e2241f8812cb3e3d5744

          SHA256

          6a320e135997a07575d8433261146653b3b5c6dd71195ba5e0f892d20a85a09d

          SHA512

          ad99c68a7c31df3d26f195e758e76aed1a4a00f4ef4ad25af5812e3be27940a3002428ec21121be54e47f13ec3145b5c46568e83ff98898f8a52aef8884bea52

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dienetwoov.exe

          Filesize

          391.0MB

          MD5

          d57db4d9896f6a1b0f72e4503ba94ed0

          SHA1

          e4dc13b4c7ee490bd268e2241f8812cb3e3d5744

          SHA256

          6a320e135997a07575d8433261146653b3b5c6dd71195ba5e0f892d20a85a09d

          SHA512

          ad99c68a7c31df3d26f195e758e76aed1a4a00f4ef4ad25af5812e3be27940a3002428ec21121be54e47f13ec3145b5c46568e83ff98898f8a52aef8884bea52

        • memory/364-138-0x0000000004C00000-0x0000000004C0A000-memory.dmp

          Filesize

          40KB

        • memory/364-135-0x00000000000A0000-0x00000000000A8000-memory.dmp

          Filesize

          32KB

        • memory/364-136-0x0000000004F10000-0x00000000054B4000-memory.dmp

          Filesize

          5.6MB

        • memory/364-137-0x0000000004A50000-0x0000000004AE2000-memory.dmp

          Filesize

          584KB

        • memory/364-139-0x0000000007EB0000-0x0000000007ED2000-memory.dmp

          Filesize

          136KB

        • memory/372-169-0x00000000078B0000-0x00000000078B8000-memory.dmp

          Filesize

          32KB

        • memory/372-164-0x0000000006930000-0x000000000694E000-memory.dmp

          Filesize

          120KB

        • memory/372-168-0x00000000078D0000-0x00000000078EA000-memory.dmp

          Filesize

          104KB

        • memory/372-165-0x0000000007720000-0x000000000772A000-memory.dmp

          Filesize

          40KB

        • memory/372-160-0x0000000070D90000-0x0000000070DDC000-memory.dmp

          Filesize

          304KB

        • memory/372-166-0x0000000007970000-0x0000000007A06000-memory.dmp

          Filesize

          600KB

        • memory/372-167-0x0000000006A10000-0x0000000006A1E000-memory.dmp

          Filesize

          56KB

        • memory/372-159-0x0000000006960000-0x0000000006992000-memory.dmp

          Filesize

          200KB

        • memory/1180-141-0x0000000002F60000-0x0000000002F96000-memory.dmp

          Filesize

          216KB

        • memory/1180-147-0x0000000006A40000-0x0000000006A5A000-memory.dmp

          Filesize

          104KB

        • memory/1180-146-0x0000000007E10000-0x000000000848A000-memory.dmp

          Filesize

          6.5MB

        • memory/1180-145-0x0000000006500000-0x000000000651E000-memory.dmp

          Filesize

          120KB

        • memory/1180-144-0x0000000005F00000-0x0000000005F66000-memory.dmp

          Filesize

          408KB

        • memory/1180-143-0x0000000005E90000-0x0000000005EF6000-memory.dmp

          Filesize

          408KB

        • memory/1180-142-0x00000000056F0000-0x0000000005D18000-memory.dmp

          Filesize

          6.2MB

        • memory/5032-157-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/5032-154-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/5032-150-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/5032-170-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB