Analysis
-
max time kernel
55s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24-02-2023 02:02
Behavioral task
behavioral1
Sample
5ef1589d1a0c75747a2f7c193956fb7588f456a60fef3f903b12d84989e4e89a.exe
Resource
win7-20230220-en
General
-
Target
5ef1589d1a0c75747a2f7c193956fb7588f456a60fef3f903b12d84989e4e89a.exe
-
Size
3.6MB
-
MD5
dd65171f49f16928478b571996b99a33
-
SHA1
79fe9466c919cc8a0dbf88cd56a275b7276c45d1
-
SHA256
5ef1589d1a0c75747a2f7c193956fb7588f456a60fef3f903b12d84989e4e89a
-
SHA512
49f54e2b8110d15dce742032c2e0fc63b308b2f465159c117254ed152468fe78e9fff6f4c805936900fb527942171ebc210b95b49f9d7b4c39e5d44127c97285
-
SSDEEP
49152:+SNKBJ20GZsIuAoAEm/It5HhYyXeBwlBKw3kPXvyNiqBFpI5+wXmAE7/FRLyBhcD:hN620Rv1rrYyXeiKYk6Lus7zysp
Malware Config
Extracted
raccoon
960d8047e2829c4b87de991d706e2490
http://94.142.138.37/
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5ef1589d1a0c75747a2f7c193956fb7588f456a60fef3f903b12d84989e4e89a.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation 5ef1589d1a0c75747a2f7c193956fb7588f456a60fef3f903b12d84989e4e89a.exe -
Executes dropped EXE 1 IoCs
Processes:
44066609702584689634.exepid process 4716 44066609702584689634.exe -
Loads dropped DLL 7 IoCs
Processes:
5ef1589d1a0c75747a2f7c193956fb7588f456a60fef3f903b12d84989e4e89a.exe44066609702584689634.exepid process 3736 5ef1589d1a0c75747a2f7c193956fb7588f456a60fef3f903b12d84989e4e89a.exe 3736 5ef1589d1a0c75747a2f7c193956fb7588f456a60fef3f903b12d84989e4e89a.exe 4716 44066609702584689634.exe 4716 44066609702584689634.exe 4716 44066609702584689634.exe 4716 44066609702584689634.exe 4716 44066609702584689634.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/3736-133-0x0000000000F80000-0x000000000152C000-memory.dmp vmprotect -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
5ef1589d1a0c75747a2f7c193956fb7588f456a60fef3f903b12d84989e4e89a.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 5ef1589d1a0c75747a2f7c193956fb7588f456a60fef3f903b12d84989e4e89a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 5ef1589d1a0c75747a2f7c193956fb7588f456a60fef3f903b12d84989e4e89a.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1468 timeout.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
5ef1589d1a0c75747a2f7c193956fb7588f456a60fef3f903b12d84989e4e89a.exe44066609702584689634.exepid process 3736 5ef1589d1a0c75747a2f7c193956fb7588f456a60fef3f903b12d84989e4e89a.exe 3736 5ef1589d1a0c75747a2f7c193956fb7588f456a60fef3f903b12d84989e4e89a.exe 4716 44066609702584689634.exe 4716 44066609702584689634.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
5ef1589d1a0c75747a2f7c193956fb7588f456a60fef3f903b12d84989e4e89a.execmd.exedescription pid process target process PID 3736 wrote to memory of 4716 3736 5ef1589d1a0c75747a2f7c193956fb7588f456a60fef3f903b12d84989e4e89a.exe 44066609702584689634.exe PID 3736 wrote to memory of 4716 3736 5ef1589d1a0c75747a2f7c193956fb7588f456a60fef3f903b12d84989e4e89a.exe 44066609702584689634.exe PID 3736 wrote to memory of 4716 3736 5ef1589d1a0c75747a2f7c193956fb7588f456a60fef3f903b12d84989e4e89a.exe 44066609702584689634.exe PID 3736 wrote to memory of 2376 3736 5ef1589d1a0c75747a2f7c193956fb7588f456a60fef3f903b12d84989e4e89a.exe cmd.exe PID 3736 wrote to memory of 2376 3736 5ef1589d1a0c75747a2f7c193956fb7588f456a60fef3f903b12d84989e4e89a.exe cmd.exe PID 3736 wrote to memory of 2376 3736 5ef1589d1a0c75747a2f7c193956fb7588f456a60fef3f903b12d84989e4e89a.exe cmd.exe PID 2376 wrote to memory of 1468 2376 cmd.exe timeout.exe PID 2376 wrote to memory of 1468 2376 cmd.exe timeout.exe PID 2376 wrote to memory of 1468 2376 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ef1589d1a0c75747a2f7c193956fb7588f456a60fef3f903b12d84989e4e89a.exe"C:\Users\Admin\AppData\Local\Temp\5ef1589d1a0c75747a2f7c193956fb7588f456a60fef3f903b12d84989e4e89a.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\44066609702584689634.exe"C:\ProgramData\44066609702584689634.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\5ef1589d1a0c75747a2f7c193956fb7588f456a60fef3f903b12d84989e4e89a.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\44066609702584689634.exeFilesize
6.6MB
MD5900d27e6128c54af6b69cf16612ef16b
SHA1e21cfcd4e5767612b050ae2fed4868480af4ea1a
SHA25601e388da881c2c5b5689b1c9919ee092ffd24b269e5760159c75b5478d1e4b58
SHA512d4e7feedbe5294093ca4bab47c1285e3bfec493e4fd93289b355e2e056b486fe3addaa132cb03d9db86367a24d8b9129a172d1588c3bbe6abed4cbbbf67ddc5f
-
C:\ProgramData\44066609702584689634.exeFilesize
6.6MB
MD5900d27e6128c54af6b69cf16612ef16b
SHA1e21cfcd4e5767612b050ae2fed4868480af4ea1a
SHA25601e388da881c2c5b5689b1c9919ee092ffd24b269e5760159c75b5478d1e4b58
SHA512d4e7feedbe5294093ca4bab47c1285e3bfec493e4fd93289b355e2e056b486fe3addaa132cb03d9db86367a24d8b9129a172d1588c3bbe6abed4cbbbf67ddc5f
-
C:\ProgramData\44066609702584689634.exeFilesize
6.6MB
MD5900d27e6128c54af6b69cf16612ef16b
SHA1e21cfcd4e5767612b050ae2fed4868480af4ea1a
SHA25601e388da881c2c5b5689b1c9919ee092ffd24b269e5760159c75b5478d1e4b58
SHA512d4e7feedbe5294093ca4bab47c1285e3bfec493e4fd93289b355e2e056b486fe3addaa132cb03d9db86367a24d8b9129a172d1588c3bbe6abed4cbbbf67ddc5f
-
C:\ProgramData\MSVCP140.dllFilesize
439KB
MD55ff1fca37c466d6723ec67be93b51442
SHA134cc4e158092083b13d67d6d2bc9e57b798a303b
SHA2565136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA5124802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546
-
C:\ProgramData\VCRUNTIME140.dllFilesize
78KB
MD5a37ee36b536409056a86f50e67777dd7
SHA11cafa159292aa736fc595fc04e16325b27cd6750
SHA2568934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA5123a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\ProgramData\msvcp140.dllFilesize
439KB
MD55ff1fca37c466d6723ec67be93b51442
SHA134cc4e158092083b13d67d6d2bc9e57b798a303b
SHA2565136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA5124802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546
-
C:\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
C:\ProgramData\vcruntime140.dllFilesize
78KB
MD5a37ee36b536409056a86f50e67777dd7
SHA11cafa159292aa736fc595fc04e16325b27cd6750
SHA2568934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA5123a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356
-
C:\Users\Admin\AppData\LocalLow\emfeq8x3YsE9Filesize
92KB
MD5c9f27e93d4d2fb6dc5d4d1d2f7d529db
SHA1cc44dd47cabe4d2ebba14361f8b5254064d365d3
SHA256d724f78d92cc963b4a06a12a310c0f5411b1ce42361dcfc498a5759efe9fdd7c
SHA512f7cc478278a5725e18ac8c7ff715fd88798b4562412d354925711c25353277ff2044d3c4a314d76f987006941b35cdde43deb9df4397b37689f67cb8fe541472
-
C:\Users\Admin\AppData\LocalLow\nss3.dllFilesize
1.9MB
MD5f67d08e8c02574cbc2f1122c53bfb976
SHA16522992957e7e4d074947cad63189f308a80fcf2
SHA256c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e
SHA5122e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5
-
C:\Users\Admin\AppData\LocalLow\rY2r4OtE3fwFFilesize
112KB
MD5780853cddeaee8de70f28a4b255a600b
SHA1ad7a5da33f7ad12946153c497e990720b09005ed
SHA2561055ff62de3dea7645c732583242adf4164bdcfb9dd37d9b35bbb9510d59b0a3
SHA512e422863112084bb8d11c682482e780cd63c2f20c8e3a93ed3b9efd1b04d53eb5d3c8081851ca89b74d66f3d9ab48eb5f6c74550484f46e7c6e460a8250c9b1d8
-
C:\Users\Admin\AppData\LocalLow\sqlite3.dllFilesize
1.0MB
MD5dbf4f8dcefb8056dc6bae4b67ff810ce
SHA1bbac1dd8a07c6069415c04b62747d794736d0689
SHA25647b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68
SHA512b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1
-
memory/3736-145-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/3736-133-0x0000000000F80000-0x000000000152C000-memory.dmpFilesize
5.7MB
-
memory/4716-240-0x0000000002BB0000-0x0000000002BB1000-memory.dmpFilesize
4KB
-
memory/4716-239-0x0000000002BA0000-0x0000000002BA1000-memory.dmpFilesize
4KB
-
memory/4716-238-0x0000000002B90000-0x0000000002B91000-memory.dmpFilesize
4KB
-
memory/4716-237-0x0000000002B80000-0x0000000002B81000-memory.dmpFilesize
4KB
-
memory/4716-236-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB
-
memory/4716-235-0x0000000002B50000-0x0000000002B51000-memory.dmpFilesize
4KB
-
memory/4716-234-0x0000000000E90000-0x0000000000E91000-memory.dmpFilesize
4KB
-
memory/4716-241-0x0000000000400000-0x0000000000E35000-memory.dmpFilesize
10.2MB
-
memory/4716-288-0x0000000061E00000-0x0000000061EF1000-memory.dmpFilesize
964KB