Analysis
-
max time kernel
137s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25-02-2023 20:18
Static task
static1
Behavioral task
behavioral1
Sample
e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe
Resource
win10v2004-20230220-en
General
-
Target
e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe
-
Size
775KB
-
MD5
a680ae77d7dcbc614386f1b4ae2d6574
-
SHA1
a263a39a2b7fd3c5fb0bb75caa789f2055f3462b
-
SHA256
e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742
-
SHA512
21327f7749f36cfa82d13479568ef92dd7737b7fd03fcef0ff55cf0db7511c8306178c597b0dc84383ce5d476cc02ae1e22c032c257a0032cd51fbaba9ff4f16
-
SSDEEP
12288:WxmGsdY0LoOaHwKeoE4LdPc/u+mVC2Blvt8Y8fAnnac6bVIhh+y:WxEpL6TFFifAnnObmh+
Malware Config
Extracted
raccoon
4b9b8980a10a7e59f200af975a29a100ba819fe0
-
url4cnc
http://telemirror.top/ararius809b
http://tgmirror.top/ararius809b
http://telegatt.top/ararius809b
http://telegka.top/ararius809b
http://telegin.top/ararius809b
https://t.me/ararius809b
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exedescription pid process target process PID 4500 set thread context of 3280 4500 e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2420 4500 WerFault.exe e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exedescription pid process target process PID 4500 wrote to memory of 3280 4500 e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe AppLaunch.exe PID 4500 wrote to memory of 3280 4500 e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe AppLaunch.exe PID 4500 wrote to memory of 3280 4500 e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe AppLaunch.exe PID 4500 wrote to memory of 3280 4500 e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe AppLaunch.exe PID 4500 wrote to memory of 3280 4500 e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe"C:\Users\Admin\AppData\Local\Temp\e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 2682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4500 -ip 45001⤵