Analysis
-
max time kernel
91s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
31-01-2023 12:54
Static task
static1
Behavioral task
behavioral1
Sample
c67b980d4c9a5653c627558ae7d16870f545456a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c67b980d4c9a5653c627558ae7d16870f545456a.exe
Resource
win10v2004-20220812-en
General
-
Target
c67b980d4c9a5653c627558ae7d16870f545456a.exe
-
Size
520KB
-
MD5
c0179ae2f540610782ddcefa56a7c512
-
SHA1
c67b980d4c9a5653c627558ae7d16870f545456a
-
SHA256
054888dc2214982e2c8204d6b304c7d719f1f221afc9dfcc65dd941d4028a332
-
SHA512
d7f052144846f9554139e9a0697ff0e7009ced6f67eefaf5b91c99bd783401f99d7941a31490a91007ce00fedca6eac2f15591c661dab8e423799f55f5246b0c
-
SSDEEP
6144:dYb3Yp1p/5R04X65ml66joPiMtTHt2erzXwixmkGLAIBch6dB7FWKkAl7zGihJYl:1p/5R0g6QwlJRGLAIBcosKn7SE1
Malware Config
Extracted
raccoon
ff85621b9b7e77782fcfd9e75aa2a3e1
http://80.85.139.245/
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 15 2984 powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs
Processes:
powershell.exepid process 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 2984 set thread context of 3096 2984 powershell.exe aspnet_compiler.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepid process 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2984 powershell.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
c67b980d4c9a5653c627558ae7d16870f545456a.exepowershell.exedescription pid process target process PID 1768 wrote to memory of 2984 1768 c67b980d4c9a5653c627558ae7d16870f545456a.exe powershell.exe PID 1768 wrote to memory of 2984 1768 c67b980d4c9a5653c627558ae7d16870f545456a.exe powershell.exe PID 1768 wrote to memory of 2984 1768 c67b980d4c9a5653c627558ae7d16870f545456a.exe powershell.exe PID 2984 wrote to memory of 3096 2984 powershell.exe aspnet_compiler.exe PID 2984 wrote to memory of 3096 2984 powershell.exe aspnet_compiler.exe PID 2984 wrote to memory of 3096 2984 powershell.exe aspnet_compiler.exe PID 2984 wrote to memory of 3096 2984 powershell.exe aspnet_compiler.exe PID 2984 wrote to memory of 3096 2984 powershell.exe aspnet_compiler.exe PID 2984 wrote to memory of 3096 2984 powershell.exe aspnet_compiler.exe PID 2984 wrote to memory of 3096 2984 powershell.exe aspnet_compiler.exe PID 2984 wrote to memory of 3096 2984 powershell.exe aspnet_compiler.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c67b980d4c9a5653c627558ae7d16870f545456a.exe"C:\Users\Admin\AppData\Local\Temp\c67b980d4c9a5653c627558ae7d16870f545456a.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1768-132-0x0000000000470000-0x00000000004F2000-memory.dmpFilesize
520KB
-
memory/1768-133-0x0000000005490000-0x0000000005A34000-memory.dmpFilesize
5.6MB
-
memory/1768-134-0x0000000004EE0000-0x0000000004F72000-memory.dmpFilesize
584KB
-
memory/1768-135-0x0000000004EA0000-0x0000000004EAA000-memory.dmpFilesize
40KB
-
memory/2984-136-0x0000000000000000-mapping.dmp
-
memory/2984-137-0x0000000004B40000-0x0000000004B76000-memory.dmpFilesize
216KB
-
memory/2984-138-0x0000000005260000-0x0000000005888000-memory.dmpFilesize
6.2MB
-
memory/2984-139-0x0000000005990000-0x00000000059B2000-memory.dmpFilesize
136KB
-
memory/2984-140-0x0000000005A30000-0x0000000005A96000-memory.dmpFilesize
408KB
-
memory/2984-141-0x0000000005B10000-0x0000000005B76000-memory.dmpFilesize
408KB
-
memory/2984-142-0x0000000006120000-0x000000000613E000-memory.dmpFilesize
120KB
-
memory/2984-143-0x00000000066A0000-0x00000000066E4000-memory.dmpFilesize
272KB
-
memory/2984-144-0x0000000007480000-0x00000000074F6000-memory.dmpFilesize
472KB
-
memory/2984-145-0x0000000007B80000-0x00000000081FA000-memory.dmpFilesize
6.5MB
-
memory/2984-146-0x0000000007440000-0x000000000745A000-memory.dmpFilesize
104KB
-
memory/3096-147-0x0000000000000000-mapping.dmp
-
memory/3096-148-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3096-150-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3096-151-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3096-152-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB