Analysis
-
max time kernel
61s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
31-01-2023 12:57
Static task
static1
Behavioral task
behavioral1
Sample
c67b980d4c9a5653c627558ae7d16870f545456a.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c67b980d4c9a5653c627558ae7d16870f545456a.exe
Resource
win10v2004-20220812-en
General
-
Target
c67b980d4c9a5653c627558ae7d16870f545456a.exe
-
Size
520KB
-
MD5
c0179ae2f540610782ddcefa56a7c512
-
SHA1
c67b980d4c9a5653c627558ae7d16870f545456a
-
SHA256
054888dc2214982e2c8204d6b304c7d719f1f221afc9dfcc65dd941d4028a332
-
SHA512
d7f052144846f9554139e9a0697ff0e7009ced6f67eefaf5b91c99bd783401f99d7941a31490a91007ce00fedca6eac2f15591c661dab8e423799f55f5246b0c
-
SSDEEP
6144:dYb3Yp1p/5R04X65ml66joPiMtTHt2erzXwixmkGLAIBch6dB7FWKkAl7zGihJYl:1p/5R0g6QwlJRGLAIBcosKn7SE1
Malware Config
Extracted
raccoon
ff85621b9b7e77782fcfd9e75aa2a3e1
http://80.85.139.245/
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 9 5072 powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs
Processes:
powershell.exepid process 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 5072 set thread context of 4164 5072 powershell.exe aspnet_compiler.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepid process 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 5072 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
c67b980d4c9a5653c627558ae7d16870f545456a.exepowershell.exedescription pid process target process PID 4172 wrote to memory of 5072 4172 c67b980d4c9a5653c627558ae7d16870f545456a.exe powershell.exe PID 4172 wrote to memory of 5072 4172 c67b980d4c9a5653c627558ae7d16870f545456a.exe powershell.exe PID 4172 wrote to memory of 5072 4172 c67b980d4c9a5653c627558ae7d16870f545456a.exe powershell.exe PID 5072 wrote to memory of 4868 5072 powershell.exe aspnet_compiler.exe PID 5072 wrote to memory of 4868 5072 powershell.exe aspnet_compiler.exe PID 5072 wrote to memory of 4868 5072 powershell.exe aspnet_compiler.exe PID 5072 wrote to memory of 4164 5072 powershell.exe aspnet_compiler.exe PID 5072 wrote to memory of 4164 5072 powershell.exe aspnet_compiler.exe PID 5072 wrote to memory of 4164 5072 powershell.exe aspnet_compiler.exe PID 5072 wrote to memory of 4164 5072 powershell.exe aspnet_compiler.exe PID 5072 wrote to memory of 4164 5072 powershell.exe aspnet_compiler.exe PID 5072 wrote to memory of 4164 5072 powershell.exe aspnet_compiler.exe PID 5072 wrote to memory of 4164 5072 powershell.exe aspnet_compiler.exe PID 5072 wrote to memory of 4164 5072 powershell.exe aspnet_compiler.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c67b980d4c9a5653c627558ae7d16870f545456a.exe"C:\Users\Admin\AppData\Local\Temp\c67b980d4c9a5653c627558ae7d16870f545456a.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4164-152-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4164-151-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4164-149-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4164-148-0x0000000000000000-mapping.dmp
-
memory/4172-133-0x0000000005060000-0x0000000005604000-memory.dmpFilesize
5.6MB
-
memory/4172-134-0x0000000004AB0000-0x0000000004B42000-memory.dmpFilesize
584KB
-
memory/4172-135-0x0000000004A90000-0x0000000004A9A000-memory.dmpFilesize
40KB
-
memory/4172-132-0x0000000000060000-0x00000000000E2000-memory.dmpFilesize
520KB
-
memory/4868-147-0x0000000000000000-mapping.dmp
-
memory/5072-137-0x0000000002830000-0x0000000002866000-memory.dmpFilesize
216KB
-
memory/5072-142-0x0000000006170000-0x000000000618E000-memory.dmpFilesize
120KB
-
memory/5072-143-0x00000000072F0000-0x0000000007334000-memory.dmpFilesize
272KB
-
memory/5072-144-0x0000000007450000-0x00000000074C6000-memory.dmpFilesize
472KB
-
memory/5072-145-0x0000000007B50000-0x00000000081CA000-memory.dmpFilesize
6.5MB
-
memory/5072-146-0x00000000074F0000-0x000000000750A000-memory.dmpFilesize
104KB
-
memory/5072-141-0x0000000005920000-0x0000000005986000-memory.dmpFilesize
408KB
-
memory/5072-140-0x00000000058B0000-0x0000000005916000-memory.dmpFilesize
408KB
-
memory/5072-139-0x00000000051A0000-0x00000000051C2000-memory.dmpFilesize
136KB
-
memory/5072-138-0x0000000005210000-0x0000000005838000-memory.dmpFilesize
6.2MB
-
memory/5072-136-0x0000000000000000-mapping.dmp