Analysis
-
max time kernel
103s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
02-02-2023 09:53
Static task
static1
Behavioral task
behavioral1
Sample
BankStatement-1675331125.xll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
BankStatement-1675331125.xll
Resource
win10v2004-20220901-en
General
-
Target
BankStatement-1675331125.xll
-
Size
74KB
-
MD5
5c287794bace944ead0a08e983d01189
-
SHA1
96985e797089f12ce9d93f3c64014835ce93e427
-
SHA256
283e57e344d4c651c214a7d92c560129b99196c444df3afda07d3bd03c73d578
-
SHA512
e07791637149e4d11f72913b15e34b63b60aa0baa6613e69e209dde7d575cbed8ce564b4a4cae8ba5dd2b046274c45e7f532d50712f77e3bf32e9767eaa72a3d
-
SSDEEP
768:6yNyZbRL5TDs0sxOUKBbZU1h4UG93elR/APDKILoJh39McLDIVdT1iHBmY:MZbJ5k0XUKBbZU12U43elwSf/IWBmY
Malware Config
Extracted
Extracted
raccoon
470ed711dadd97d5f2669317d6d3ee7d
http://102.130.113.39
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powershell.execmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1856 3248 powershell.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4936 3248 cmd.exe EXCEL.EXE -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 51 3992 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
filesetup11.5.6.exepid process 3636 filesetup11.5.6.exe -
Loads dropped DLL 5 IoCs
Processes:
EXCEL.EXEaspnet_compiler.exepid process 3248 EXCEL.EXE 3248 EXCEL.EXE 4588 aspnet_compiler.exe 4588 aspnet_compiler.exe 4588 aspnet_compiler.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs
Processes:
powershell.exepid process 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 3992 set thread context of 4588 3992 powershell.exe aspnet_compiler.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3248 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exepid process 1856 powershell.exe 1856 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1856 powershell.exe Token: SeDebugPrivilege 3992 powershell.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
EXCEL.EXEpid process 3248 EXCEL.EXE 3248 EXCEL.EXE 3248 EXCEL.EXE 3248 EXCEL.EXE 3248 EXCEL.EXE 3248 EXCEL.EXE 3248 EXCEL.EXE 3248 EXCEL.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
EXCEL.EXEcmd.exefilesetup11.5.6.exepowershell.exedescription pid process target process PID 3248 wrote to memory of 1856 3248 EXCEL.EXE powershell.exe PID 3248 wrote to memory of 1856 3248 EXCEL.EXE powershell.exe PID 3248 wrote to memory of 4936 3248 EXCEL.EXE cmd.exe PID 3248 wrote to memory of 4936 3248 EXCEL.EXE cmd.exe PID 4936 wrote to memory of 3636 4936 cmd.exe filesetup11.5.6.exe PID 4936 wrote to memory of 3636 4936 cmd.exe filesetup11.5.6.exe PID 4936 wrote to memory of 3636 4936 cmd.exe filesetup11.5.6.exe PID 3636 wrote to memory of 3992 3636 filesetup11.5.6.exe powershell.exe PID 3636 wrote to memory of 3992 3636 filesetup11.5.6.exe powershell.exe PID 3636 wrote to memory of 3992 3636 filesetup11.5.6.exe powershell.exe PID 3992 wrote to memory of 4588 3992 powershell.exe aspnet_compiler.exe PID 3992 wrote to memory of 4588 3992 powershell.exe aspnet_compiler.exe PID 3992 wrote to memory of 4588 3992 powershell.exe aspnet_compiler.exe PID 3992 wrote to memory of 4588 3992 powershell.exe aspnet_compiler.exe PID 3992 wrote to memory of 4588 3992 powershell.exe aspnet_compiler.exe PID 3992 wrote to memory of 4588 3992 powershell.exe aspnet_compiler.exe PID 3992 wrote to memory of 4588 3992 powershell.exe aspnet_compiler.exe PID 3992 wrote to memory of 4588 3992 powershell.exe aspnet_compiler.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\BankStatement-1675331125.xll"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Expand-Archive -Path "C:\Users\Admin\AppData\Local\Temp\mypictures.zip" -DestinationPath "C:\Users\Admin\AppData\Local\Temp\."2⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\cmd.execmd.exe /cstart C:\Users\Admin\AppData\Local\Temp\filesetup11.5.6\filesetup11.5.6.exe2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\filesetup11.5.6\filesetup11.5.6.exeC:\Users\Admin\AppData\Local\Temp\filesetup11.5.6\filesetup11.5.6.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell.exe"4⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe5⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\mozglue.dllFilesize
612KB
MD5f07d9977430e762b563eaadc2b94bbfa
SHA1da0a05b2b8d269fb73558dfcf0ed5c167f6d3877
SHA2564191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862
SHA5126afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf
-
C:\Users\Admin\AppData\LocalLow\nss3.dllFilesize
1.9MB
MD5f67d08e8c02574cbc2f1122c53bfb976
SHA16522992957e7e4d074947cad63189f308a80fcf2
SHA256c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e
SHA5122e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5
-
C:\Users\Admin\AppData\LocalLow\sqlite3.dllFilesize
1.0MB
MD5dbf4f8dcefb8056dc6bae4b67ff810ce
SHA1bbac1dd8a07c6069415c04b62747d794736d0689
SHA25647b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68
SHA512b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1
-
C:\Users\Admin\AppData\Local\Temp\BankStatement-1675331125.xllFilesize
74KB
MD55c287794bace944ead0a08e983d01189
SHA196985e797089f12ce9d93f3c64014835ce93e427
SHA256283e57e344d4c651c214a7d92c560129b99196c444df3afda07d3bd03c73d578
SHA512e07791637149e4d11f72913b15e34b63b60aa0baa6613e69e209dde7d575cbed8ce564b4a4cae8ba5dd2b046274c45e7f532d50712f77e3bf32e9767eaa72a3d
-
C:\Users\Admin\AppData\Local\Temp\BankStatement-1675331125.xllFilesize
74KB
MD55c287794bace944ead0a08e983d01189
SHA196985e797089f12ce9d93f3c64014835ce93e427
SHA256283e57e344d4c651c214a7d92c560129b99196c444df3afda07d3bd03c73d578
SHA512e07791637149e4d11f72913b15e34b63b60aa0baa6613e69e209dde7d575cbed8ce564b4a4cae8ba5dd2b046274c45e7f532d50712f77e3bf32e9767eaa72a3d
-
C:\Users\Admin\AppData\Local\Temp\filesetup11.5.6\filesetup11.5.6.exeFilesize
773.8MB
MD57b3810fdb7a9b67d6d38ac643f90b23f
SHA15d8d2214cf42471b334a74dee71f8ffe0d593b55
SHA256f2098134d9b02bb4dabc6ba7772c4c6b0b6964e37f2e176a7f967c24d7478fe8
SHA512a6f60a80d92e90c5429bd62d8df015641785c195c8880e7083c66bf1cea49f9c2107052eb6c26ffac2beb8e70c1e6d9f94163d8d91633b77e3fe02b9ed054d53
-
C:\Users\Admin\AppData\Local\Temp\filesetup11.5.6\filesetup11.5.6.exeFilesize
802.3MB
MD523198d981f029e70eacfd85ead80d242
SHA11dea243047f8825306433a8b4575028be65e69a0
SHA2567cfa818b013c2484d7ecebd0abfe2a6eb83e20ea77b43a926e815a21b678d58f
SHA5121956fdb9bef318c25e20c2595fad4604cc4765463f449936e8b5bcb85990e82242ca30648fc8efd0caa06794c44134e0162523758bb5026d64908f6ff4983991
-
C:\Users\Admin\AppData\Local\Temp\mypictures.zipFilesize
6.9MB
MD5b145c7b31e020809beb62b5ff5c7b66b
SHA14bfae85a04739c8c3d39b9b60b5f2afd4db5c4cf
SHA256a68bf293252d2e9f4e86646d8b0be474bf858bfb8dde2a787fd8f5e8aabd8af0
SHA51284835b1a6936f6a4c0dea466936f3f1ce438a06636b22a6a7a966aa7d1e39f028a184a21ae8e6956ba30033982eaef3716cdade9485ba2b5040ca3f965788941
-
memory/1856-144-0x000001A9E5580000-0x000001A9E5592000-memory.dmpFilesize
72KB
-
memory/1856-147-0x00007FF979C40000-0x00007FF97A701000-memory.dmpFilesize
10.8MB
-
memory/1856-142-0x000001A9E5110000-0x000001A9E5132000-memory.dmpFilesize
136KB
-
memory/1856-143-0x00007FF979C40000-0x00007FF97A701000-memory.dmpFilesize
10.8MB
-
memory/1856-141-0x0000000000000000-mapping.dmp
-
memory/1856-145-0x000001A9E50F0000-0x000001A9E50FA000-memory.dmpFilesize
40KB
-
memory/1856-148-0x00007FF979C40000-0x00007FF97A701000-memory.dmpFilesize
10.8MB
-
memory/3248-182-0x00007FF963870000-0x00007FF963880000-memory.dmpFilesize
64KB
-
memory/3248-137-0x00007FF9617E0000-0x00007FF9617F0000-memory.dmpFilesize
64KB
-
memory/3248-138-0x00007FF9617E0000-0x00007FF9617F0000-memory.dmpFilesize
64KB
-
memory/3248-136-0x00007FF963870000-0x00007FF963880000-memory.dmpFilesize
64KB
-
memory/3248-181-0x00007FF963870000-0x00007FF963880000-memory.dmpFilesize
64KB
-
memory/3248-135-0x00007FF963870000-0x00007FF963880000-memory.dmpFilesize
64KB
-
memory/3248-179-0x00007FF963870000-0x00007FF963880000-memory.dmpFilesize
64KB
-
memory/3248-180-0x00007FF963870000-0x00007FF963880000-memory.dmpFilesize
64KB
-
memory/3248-134-0x00007FF963870000-0x00007FF963880000-memory.dmpFilesize
64KB
-
memory/3248-132-0x00007FF963870000-0x00007FF963880000-memory.dmpFilesize
64KB
-
memory/3248-133-0x00007FF963870000-0x00007FF963880000-memory.dmpFilesize
64KB
-
memory/3636-156-0x0000000005B60000-0x0000000005B6A000-memory.dmpFilesize
40KB
-
memory/3636-155-0x0000000005A90000-0x0000000005B22000-memory.dmpFilesize
584KB
-
memory/3636-150-0x0000000000000000-mapping.dmp
-
memory/3636-153-0x0000000000FF0000-0x00000000010DC000-memory.dmpFilesize
944KB
-
memory/3636-154-0x0000000006040000-0x00000000065E4000-memory.dmpFilesize
5.6MB
-
memory/3992-157-0x0000000000000000-mapping.dmp
-
memory/3992-159-0x0000000004F40000-0x0000000005568000-memory.dmpFilesize
6.2MB
-
memory/3992-165-0x00000000070B0000-0x0000000007126000-memory.dmpFilesize
472KB
-
memory/3992-166-0x00000000077B0000-0x0000000007E2A000-memory.dmpFilesize
6.5MB
-
memory/3992-167-0x0000000007150000-0x000000000716A000-memory.dmpFilesize
104KB
-
memory/3992-160-0x0000000004D60000-0x0000000004D82000-memory.dmpFilesize
136KB
-
memory/3992-161-0x0000000004E00000-0x0000000004E66000-memory.dmpFilesize
408KB
-
memory/3992-162-0x00000000056E0000-0x0000000005746000-memory.dmpFilesize
408KB
-
memory/3992-163-0x0000000005DC0000-0x0000000005DDE000-memory.dmpFilesize
120KB
-
memory/3992-164-0x0000000006360000-0x00000000063A4000-memory.dmpFilesize
272KB
-
memory/3992-158-0x0000000002420000-0x0000000002456000-memory.dmpFilesize
216KB
-
memory/4588-173-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4588-172-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4588-177-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4588-171-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4588-169-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4588-168-0x0000000000000000-mapping.dmp
-
memory/4936-149-0x0000000000000000-mapping.dmp