Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
17-02-2023 10:06
Static task
static1
Behavioral task
behavioral1
Sample
e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe
Resource
win10v2004-20221111-en
General
-
Target
e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe
-
Size
775KB
-
MD5
a680ae77d7dcbc614386f1b4ae2d6574
-
SHA1
a263a39a2b7fd3c5fb0bb75caa789f2055f3462b
-
SHA256
e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742
-
SHA512
21327f7749f36cfa82d13479568ef92dd7737b7fd03fcef0ff55cf0db7511c8306178c597b0dc84383ce5d476cc02ae1e22c032c257a0032cd51fbaba9ff4f16
-
SSDEEP
12288:WxmGsdY0LoOaHwKeoE4LdPc/u+mVC2Blvt8Y8fAnnac6bVIhh+y:WxEpL6TFFifAnnObmh+
Malware Config
Extracted
raccoon
4b9b8980a10a7e59f200af975a29a100ba819fe0
-
url4cnc
http://telemirror.top/ararius809b
http://tgmirror.top/ararius809b
http://telegatt.top/ararius809b
http://telegka.top/ararius809b
http://telegin.top/ararius809b
https://t.me/ararius809b
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exedescription pid process target process PID 1728 set thread context of 2032 1728 e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe AppLaunch.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exedescription pid process target process PID 1728 wrote to memory of 2032 1728 e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe AppLaunch.exe PID 1728 wrote to memory of 2032 1728 e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe AppLaunch.exe PID 1728 wrote to memory of 2032 1728 e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe AppLaunch.exe PID 1728 wrote to memory of 2032 1728 e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe AppLaunch.exe PID 1728 wrote to memory of 2032 1728 e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe AppLaunch.exe PID 1728 wrote to memory of 2032 1728 e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe AppLaunch.exe PID 1728 wrote to memory of 2032 1728 e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe AppLaunch.exe PID 1728 wrote to memory of 2032 1728 e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe AppLaunch.exe PID 1728 wrote to memory of 2032 1728 e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe"C:\Users\Admin\AppData\Local\Temp\e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2032-54-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/2032-56-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/2032-62-0x000000000043E9BE-mapping.dmp
-
memory/2032-63-0x0000000076391000-0x0000000076393000-memory.dmpFilesize
8KB
-
memory/2032-64-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/2032-65-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB