Analysis
-
max time kernel
91s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-01-2023 13:13
Static task
static1
Behavioral task
behavioral1
Sample
e7f78e22526692e61b0df20f2f6a7d22918d6b8ed0d8489db583a0e60952ff67.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e7f78e22526692e61b0df20f2f6a7d22918d6b8ed0d8489db583a0e60952ff67.exe
Resource
win10v2004-20220812-en
General
-
Target
e7f78e22526692e61b0df20f2f6a7d22918d6b8ed0d8489db583a0e60952ff67.exe
-
Size
6.2MB
-
MD5
24085f579497e4adda77ea8e3101efe4
-
SHA1
fe29633a73efe06ffed1954be236aa9e49e2a762
-
SHA256
e7f78e22526692e61b0df20f2f6a7d22918d6b8ed0d8489db583a0e60952ff67
-
SHA512
332a558c0264bfe9b09a630fa9d9637742df0933540defc933ec00a43556eaa74e1b3f996edacd95bf0b98bb905481144dc7815777126bfdfa5815e1a5bbe3bc
-
SSDEEP
98304:2d+HKGRyh0wuVmd1USdtQ1TdEHSHBbmXLXKDSxWdyzxN0ARU6CjvpGbSrvLCoWwj:2UM8s+GoBbCXDxPxNaNGb6L31
Malware Config
Extracted
raccoon
5c28acbbf9d03405995950480f1c9638
http://193.149.187.53/
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
e7f78e22526692e61b0df20f2f6a7d22918d6b8ed0d8489db583a0e60952ff67.exepid process 2820 e7f78e22526692e61b0df20f2f6a7d22918d6b8ed0d8489db583a0e60952ff67.exe 2820 e7f78e22526692e61b0df20f2f6a7d22918d6b8ed0d8489db583a0e60952ff67.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
e7f78e22526692e61b0df20f2f6a7d22918d6b8ed0d8489db583a0e60952ff67.exepid process 2820 e7f78e22526692e61b0df20f2f6a7d22918d6b8ed0d8489db583a0e60952ff67.exe 2820 e7f78e22526692e61b0df20f2f6a7d22918d6b8ed0d8489db583a0e60952ff67.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7f78e22526692e61b0df20f2f6a7d22918d6b8ed0d8489db583a0e60952ff67.exe"C:\Users\Admin\AppData\Local\Temp\e7f78e22526692e61b0df20f2f6a7d22918d6b8ed0d8489db583a0e60952ff67.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses