Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 17:53
Static task
static1
Behavioral task
behavioral1
Sample
0df4d085fc7efb1700b9d547006eae8ccfe1edeee8395555ff15e476d7736236.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0df4d085fc7efb1700b9d547006eae8ccfe1edeee8395555ff15e476d7736236.exe
Resource
win10v2004-20220901-en
General
-
Target
0df4d085fc7efb1700b9d547006eae8ccfe1edeee8395555ff15e476d7736236.exe
-
Size
538KB
-
MD5
3e50c05017763de7bad56f03afc4406f
-
SHA1
05ff58d27dbd36c54f9a19f909feb79591fe361d
-
SHA256
0df4d085fc7efb1700b9d547006eae8ccfe1edeee8395555ff15e476d7736236
-
SHA512
59e89952f14324b973f2aeb0f71f80d283b97404840e09e6aaf3e6bcc93053cba8cc73df1d4aea4d1106c6d9d5043d1cc42cefe9c47200254ef2432bca10beef
-
SSDEEP
12288:FFexvwQ0qfjdLu4tnpIZkAtLCopegKGFaSeO03nC/JZQV0:FouVqf5dsC6OoggRanO0XkJZQV
Malware Config
Extracted
raccoon
1.7.2
a3a85b69314053c3bb015532d1a960a3d08baeb8
-
url4cnc
https://telete.in/baudemars
Signatures
-
Raccoon Stealer payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4976-133-0x0000000000880000-0x0000000000912000-memory.dmp family_raccoon behavioral2/memory/4976-134-0x0000000000400000-0x0000000000880000-memory.dmp family_raccoon -
Program crash 6 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4452 4976 WerFault.exe 0df4d085fc7efb1700b9d547006eae8ccfe1edeee8395555ff15e476d7736236.exe 4128 4976 WerFault.exe 0df4d085fc7efb1700b9d547006eae8ccfe1edeee8395555ff15e476d7736236.exe 2956 4976 WerFault.exe 0df4d085fc7efb1700b9d547006eae8ccfe1edeee8395555ff15e476d7736236.exe 2384 4976 WerFault.exe 0df4d085fc7efb1700b9d547006eae8ccfe1edeee8395555ff15e476d7736236.exe 772 4976 WerFault.exe 0df4d085fc7efb1700b9d547006eae8ccfe1edeee8395555ff15e476d7736236.exe 3824 4976 WerFault.exe 0df4d085fc7efb1700b9d547006eae8ccfe1edeee8395555ff15e476d7736236.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0df4d085fc7efb1700b9d547006eae8ccfe1edeee8395555ff15e476d7736236.exe"C:\Users\Admin\AppData\Local\Temp\0df4d085fc7efb1700b9d547006eae8ccfe1edeee8395555ff15e476d7736236.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 7402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 7762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 8922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 9122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 11002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 11602⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4976 -ip 49761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4976 -ip 49761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4976 -ip 49761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4976 -ip 49761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4976 -ip 49761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4976 -ip 49761⤵