Analysis
-
max time kernel
90s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
07-02-2023 07:01
Static task
static1
Behavioral task
behavioral1
Sample
7daf07f31b4c9a8f7bebdf7cf06c1de2bffcd2df70f675bcc995906054a77177.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7daf07f31b4c9a8f7bebdf7cf06c1de2bffcd2df70f675bcc995906054a77177.exe
Resource
win10v2004-20221111-en
General
-
Target
7daf07f31b4c9a8f7bebdf7cf06c1de2bffcd2df70f675bcc995906054a77177.exe
-
Size
408KB
-
MD5
30e3a74a9d29671b7638499ef5d59053
-
SHA1
2361cc3085465e3d8e632395b8d5a07ea029c028
-
SHA256
7daf07f31b4c9a8f7bebdf7cf06c1de2bffcd2df70f675bcc995906054a77177
-
SHA512
14f0040df92886d90c277076b9e90c015c2daccfa20f25da84146359eebd8c299d3102593fca0f27053fdf1550afc03ce59381b963e0c887def0ea029abdf09e
-
SSDEEP
6144:xLmBZYc9gTIu3mJ4f5PY+fUXxBN0KOUg0QV3fj1wUcw8tx2/kpZOwBuHBTpOdN87:xLGZCTV/qkjJwUcw8D2/k3OH
Malware Config
Extracted
raccoon
2dbfb7ebbdc8183124d0ac1729de140a
http://45.15.156.62
Signatures
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
7daf07f31b4c9a8f7bebdf7cf06c1de2bffcd2df70f675bcc995906054a77177.exedescription pid process target process PID 4880 set thread context of 4744 4880 7daf07f31b4c9a8f7bebdf7cf06c1de2bffcd2df70f675bcc995906054a77177.exe vbc.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
7daf07f31b4c9a8f7bebdf7cf06c1de2bffcd2df70f675bcc995906054a77177.exedescription pid process target process PID 4880 wrote to memory of 4744 4880 7daf07f31b4c9a8f7bebdf7cf06c1de2bffcd2df70f675bcc995906054a77177.exe vbc.exe PID 4880 wrote to memory of 4744 4880 7daf07f31b4c9a8f7bebdf7cf06c1de2bffcd2df70f675bcc995906054a77177.exe vbc.exe PID 4880 wrote to memory of 4744 4880 7daf07f31b4c9a8f7bebdf7cf06c1de2bffcd2df70f675bcc995906054a77177.exe vbc.exe PID 4880 wrote to memory of 4744 4880 7daf07f31b4c9a8f7bebdf7cf06c1de2bffcd2df70f675bcc995906054a77177.exe vbc.exe PID 4880 wrote to memory of 4744 4880 7daf07f31b4c9a8f7bebdf7cf06c1de2bffcd2df70f675bcc995906054a77177.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7daf07f31b4c9a8f7bebdf7cf06c1de2bffcd2df70f675bcc995906054a77177.exe"C:\Users\Admin\AppData\Local\Temp\7daf07f31b4c9a8f7bebdf7cf06c1de2bffcd2df70f675bcc995906054a77177.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\vbc.exe"2⤵