Analysis
-
max time kernel
105s -
max time network
74s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
25-03-2023 14:08
Behavioral task
behavioral1
Sample
aad928ec7a88f5570de0bfaa270d0548.exe
Resource
win7-20230220-en
General
-
Target
aad928ec7a88f5570de0bfaa270d0548.exe
-
Size
20.0MB
-
MD5
aad928ec7a88f5570de0bfaa270d0548
-
SHA1
084453356043aac2acf583ee9a543275ecb3654a
-
SHA256
afac9fa41b9b5790863b0674e7315bd82bc890c647ac635c4435c4798e65a3dc
-
SHA512
85ce4046d9ac49b2ce38c035276b3597b157d1e0b59153d65a29c8671a1197ec3f32d13c466c725e1cd97a97a2697ebf8d12663486d87db086363237cbbc6f6a
-
SSDEEP
98304:3Vde8FivCeGDRsiSc/XBgZrzyWGgRSL6O2jSk6adBNWuz+VRD0MbQY:HZFwAur6XBazEgRSSjS5aT1z+/D0yQY
Malware Config
Extracted
raccoon
540b1db0b12b23e63e6942952aa03e47
http://45.9.74.36/
http://45.9.74.34/
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
Q0f87tGn.exe20jp17Kv.exepid process 896 Q0f87tGn.exe 1248 20jp17Kv.exe -
Loads dropped DLL 7 IoCs
Processes:
aad928ec7a88f5570de0bfaa270d0548.exepid process 2000 aad928ec7a88f5570de0bfaa270d0548.exe 2000 aad928ec7a88f5570de0bfaa270d0548.exe 2000 aad928ec7a88f5570de0bfaa270d0548.exe 2000 aad928ec7a88f5570de0bfaa270d0548.exe 2000 aad928ec7a88f5570de0bfaa270d0548.exe 2000 aad928ec7a88f5570de0bfaa270d0548.exe 2000 aad928ec7a88f5570de0bfaa270d0548.exe -
Modifies file permissions 1 TTPs 3 IoCs
Processes:
icacls.exeicacls.exeicacls.exepid process 2032 icacls.exe 924 icacls.exe 1708 icacls.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule \ProgramData\DesktopDocuments-type6.0.7.6\DesktopDocuments-type6.0.7.6.exe upx \ProgramData\DesktopDocuments-type6.0.7.6\DesktopDocuments-type6.0.7.6.exe upx C:\ProgramData\DesktopDocuments-type6.0.7.6\DesktopDocuments-type6.0.7.6.exe upx C:\ProgramData\DesktopDocuments-type6.0.7.6\DesktopDocuments-type6.0.7.6.exe upx C:\ProgramData\DesktopDocuments-type6.0.7.6\DesktopDocuments-type6.0.7.6.exe upx behavioral1/memory/1868-133-0x000000013FEA0000-0x00000001403BF000-memory.dmp upx behavioral1/memory/1868-134-0x000000013FEA0000-0x00000001403BF000-memory.dmp upx behavioral1/memory/1868-135-0x000000013FEA0000-0x00000001403BF000-memory.dmp upx behavioral1/memory/1868-136-0x000000013FEA0000-0x00000001403BF000-memory.dmp upx -
Processes:
resource yara_rule behavioral1/memory/2000-54-0x0000000000400000-0x000000000091F000-memory.dmp vmprotect -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Q0f87tGn.exedescription pid process target process PID 896 set thread context of 1900 896 Q0f87tGn.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
aad928ec7a88f5570de0bfaa270d0548.exe20jp17Kv.execmd.exeQ0f87tGn.exeAppLaunch.exedescription pid process target process PID 2000 wrote to memory of 896 2000 aad928ec7a88f5570de0bfaa270d0548.exe Q0f87tGn.exe PID 2000 wrote to memory of 896 2000 aad928ec7a88f5570de0bfaa270d0548.exe Q0f87tGn.exe PID 2000 wrote to memory of 896 2000 aad928ec7a88f5570de0bfaa270d0548.exe Q0f87tGn.exe PID 2000 wrote to memory of 896 2000 aad928ec7a88f5570de0bfaa270d0548.exe Q0f87tGn.exe PID 2000 wrote to memory of 1248 2000 aad928ec7a88f5570de0bfaa270d0548.exe 20jp17Kv.exe PID 2000 wrote to memory of 1248 2000 aad928ec7a88f5570de0bfaa270d0548.exe 20jp17Kv.exe PID 2000 wrote to memory of 1248 2000 aad928ec7a88f5570de0bfaa270d0548.exe 20jp17Kv.exe PID 2000 wrote to memory of 1248 2000 aad928ec7a88f5570de0bfaa270d0548.exe 20jp17Kv.exe PID 1248 wrote to memory of 1400 1248 20jp17Kv.exe cmd.exe PID 1248 wrote to memory of 1400 1248 20jp17Kv.exe cmd.exe PID 1248 wrote to memory of 1400 1248 20jp17Kv.exe cmd.exe PID 1400 wrote to memory of 2004 1400 cmd.exe choice.exe PID 1400 wrote to memory of 2004 1400 cmd.exe choice.exe PID 1400 wrote to memory of 2004 1400 cmd.exe choice.exe PID 896 wrote to memory of 1900 896 Q0f87tGn.exe AppLaunch.exe PID 896 wrote to memory of 1900 896 Q0f87tGn.exe AppLaunch.exe PID 896 wrote to memory of 1900 896 Q0f87tGn.exe AppLaunch.exe PID 896 wrote to memory of 1900 896 Q0f87tGn.exe AppLaunch.exe PID 896 wrote to memory of 1900 896 Q0f87tGn.exe AppLaunch.exe PID 896 wrote to memory of 1900 896 Q0f87tGn.exe AppLaunch.exe PID 896 wrote to memory of 1900 896 Q0f87tGn.exe AppLaunch.exe PID 896 wrote to memory of 1900 896 Q0f87tGn.exe AppLaunch.exe PID 896 wrote to memory of 1900 896 Q0f87tGn.exe AppLaunch.exe PID 1900 wrote to memory of 2032 1900 AppLaunch.exe icacls.exe PID 1900 wrote to memory of 2032 1900 AppLaunch.exe icacls.exe PID 1900 wrote to memory of 2032 1900 AppLaunch.exe icacls.exe PID 1900 wrote to memory of 2032 1900 AppLaunch.exe icacls.exe PID 1900 wrote to memory of 2032 1900 AppLaunch.exe icacls.exe PID 1900 wrote to memory of 2032 1900 AppLaunch.exe icacls.exe PID 1900 wrote to memory of 2032 1900 AppLaunch.exe icacls.exe PID 1900 wrote to memory of 924 1900 AppLaunch.exe icacls.exe PID 1900 wrote to memory of 924 1900 AppLaunch.exe icacls.exe PID 1900 wrote to memory of 924 1900 AppLaunch.exe icacls.exe PID 1900 wrote to memory of 924 1900 AppLaunch.exe icacls.exe PID 1900 wrote to memory of 924 1900 AppLaunch.exe icacls.exe PID 1900 wrote to memory of 924 1900 AppLaunch.exe icacls.exe PID 1900 wrote to memory of 924 1900 AppLaunch.exe icacls.exe PID 1900 wrote to memory of 1708 1900 AppLaunch.exe icacls.exe PID 1900 wrote to memory of 1708 1900 AppLaunch.exe icacls.exe PID 1900 wrote to memory of 1708 1900 AppLaunch.exe icacls.exe PID 1900 wrote to memory of 1708 1900 AppLaunch.exe icacls.exe PID 1900 wrote to memory of 1708 1900 AppLaunch.exe icacls.exe PID 1900 wrote to memory of 1708 1900 AppLaunch.exe icacls.exe PID 1900 wrote to memory of 1708 1900 AppLaunch.exe icacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aad928ec7a88f5570de0bfaa270d0548.exe"C:\Users\Admin\AppData\Local\Temp\aad928ec7a88f5570de0bfaa270d0548.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Q0f87tGn.exe"C:\Users\Admin\AppData\Roaming\Q0f87tGn.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\ProgramData\DesktopDocuments-type6.0.7.6" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\ProgramData\DesktopDocuments-type6.0.7.6" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\ProgramData\DesktopDocuments-type6.0.7.6" /inheritance:e /deny "admin:(R,REA,RA,RD)"4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /TN "DesktopDocuments-type6.0.7.6\DesktopDocuments-type6.0.7.6" /TR "C:\ProgramData\DesktopDocuments-type6.0.7.6\DesktopDocuments-type6.0.7.6.exe" /SC MINUTE4⤵
- Creates scheduled task(s)
-
C:\ProgramData\DesktopDocuments-type6.0.7.6\DesktopDocuments-type6.0.7.6.exe"C:\ProgramData\DesktopDocuments-type6.0.7.6\DesktopDocuments-type6.0.7.6.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\20jp17Kv.exe"C:\Users\Admin\AppData\Roaming\20jp17Kv.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Roaming\20jp17Kv.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 04⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\DesktopDocuments-type6.0.7.6\DesktopDocuments-type6.0.7.6.exeFilesize
110.8MB
MD5a862eb8c770a4ca487bead19c1e0cd42
SHA1fa025c7336d29b172538ef39d498d3761928aa80
SHA256af2bb719ab77d8998cda3433cedd4796d7be7cfff691704f5ab09c671e19630d
SHA51205878b3bbc8724f8feec2accd11844d3760a11c133d0ec952a592ca445588c7b066fd549727fed5d1d4c94c3a99e51e755160cbabb1d96b66417fb2e64961b92
-
C:\ProgramData\DesktopDocuments-type6.0.7.6\DesktopDocuments-type6.0.7.6.exeFilesize
124.6MB
MD56ca74d088d726528804f67de99d5ccc1
SHA19c772e22539c22bd31df8a5375bdb0e5bd6edc28
SHA256396c39a3ee80989c9ffeb840d7c54acabb1f69677036b303ce64d4f857c3f7e7
SHA51284f4c8c999781970db7697b25d3a1c40c012d6da9443f8a4ade8db714aeed264b0b68ae281e2d2c221d777d080fe4515d4402b4267ad6ae6b85b3eb4c5076cb8
-
C:\ProgramData\DesktopDocuments-type6.0.7.6\DesktopDocuments-type6.0.7.6.exeFilesize
140.0MB
MD5579e9cca5a57a889bbe559b17b61e7f3
SHA1110f8f983e02e50512c54c7a0ac77deb1da968dc
SHA2562be62180e77449541b2ce25767a51dd7b824b864d731c6713a4b1d71d9868e27
SHA51296437fe4f77a5f516706dd338d723f38aa54dbf8a02a235b331189f514698f6df2815785db93f098d0debd350871f04fef49d96adf05ff62bd0dd62008a22f45
-
C:\Users\Admin\AppData\Roaming\20jp17Kv.exeFilesize
13.9MB
MD5443785bf8b874e307b89db380dfeb164
SHA1525093ccff5a03c0a5e56e55628071a47d5be33c
SHA256dd08c49d2c91b7f446c231a6ede439fdf632d7d2f4dc4ad4ab52276b4aae96a3
SHA51240cc6d6c339ada3d5345e4472d9c0301c037c91273080bee2e498a78b83021a0b6b0686f8195217a835e3d6ed27f4d762f7f6035d227f2b1e0074bb39eae238d
-
C:\Users\Admin\AppData\Roaming\20jp17Kv.exeFilesize
13.9MB
MD5443785bf8b874e307b89db380dfeb164
SHA1525093ccff5a03c0a5e56e55628071a47d5be33c
SHA256dd08c49d2c91b7f446c231a6ede439fdf632d7d2f4dc4ad4ab52276b4aae96a3
SHA51240cc6d6c339ada3d5345e4472d9c0301c037c91273080bee2e498a78b83021a0b6b0686f8195217a835e3d6ed27f4d762f7f6035d227f2b1e0074bb39eae238d
-
C:\Users\Admin\AppData\Roaming\Q0f87tGn.exeFilesize
3.4MB
MD59d6aaaec5ec0840090a7222dfb214c00
SHA1bb5ccf4d5867adf1ece660aa55f8c758d2794b15
SHA256591587d25331629921749f7d8fc2dd4e4a1221cacc4f89bb81fe6f7f1dd448ac
SHA5129aa889111232e4c8b65a37640f93e82992950fa886394b0023311dae251b753ad5026e0a25c49ec73dbd2c6f9d89713d02e590af7566da12ef164ccaa0ab5752
-
C:\Users\Admin\AppData\Roaming\Q0f87tGn.exeFilesize
3.4MB
MD59d6aaaec5ec0840090a7222dfb214c00
SHA1bb5ccf4d5867adf1ece660aa55f8c758d2794b15
SHA256591587d25331629921749f7d8fc2dd4e4a1221cacc4f89bb81fe6f7f1dd448ac
SHA5129aa889111232e4c8b65a37640f93e82992950fa886394b0023311dae251b753ad5026e0a25c49ec73dbd2c6f9d89713d02e590af7566da12ef164ccaa0ab5752
-
\ProgramData\DesktopDocuments-type6.0.7.6\DesktopDocuments-type6.0.7.6.exeFilesize
129.6MB
MD5a3b7fb6928d7a5942ae117ef87cecf4b
SHA15e1712331a63352137e339a6411d983231fe1895
SHA25658aa4381e04c73a41328e1cccb5781f0c09aef0266e53f2953b35faafafcb0e2
SHA5129d4e3cd4ecfe909a83118fc2c52c525141d89665632be6aeab32ff33eda0599d213a515ad7951c9684ab7615cc98d24b47435150264fe0c4b662c62aaca5f370
-
\ProgramData\DesktopDocuments-type6.0.7.6\DesktopDocuments-type6.0.7.6.exeFilesize
140.2MB
MD51217eee24dab4ef1c5bc08ea6a65893d
SHA1aeb1b2567e4199c1b6ddc05ea9efce21c3695338
SHA25607276598e1b443b98e47633c7310ecc70a714b6e59cc778955274d736a605475
SHA512a05aab533ad6cea7a84587958d32bb6e891291dc796c4b570f4bd9d07559c60fa85cdb105a1aae9456ee25d2b1e5f7e0992dbae8f57cb13aa1ce1501dc670152
-
\Users\Admin\AppData\LocalLow\mozglue.dllFilesize
612KB
MD5f07d9977430e762b563eaadc2b94bbfa
SHA1da0a05b2b8d269fb73558dfcf0ed5c167f6d3877
SHA2564191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862
SHA5126afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf
-
\Users\Admin\AppData\LocalLow\nss3.dllFilesize
1.9MB
MD5f67d08e8c02574cbc2f1122c53bfb976
SHA16522992957e7e4d074947cad63189f308a80fcf2
SHA256c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e
SHA5122e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5
-
\Users\Admin\AppData\LocalLow\sqlite3.dllFilesize
1.0MB
MD5dbf4f8dcefb8056dc6bae4b67ff810ce
SHA1bbac1dd8a07c6069415c04b62747d794736d0689
SHA25647b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68
SHA512b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1
-
\Users\Admin\AppData\Roaming\20jp17Kv.exeFilesize
13.9MB
MD5443785bf8b874e307b89db380dfeb164
SHA1525093ccff5a03c0a5e56e55628071a47d5be33c
SHA256dd08c49d2c91b7f446c231a6ede439fdf632d7d2f4dc4ad4ab52276b4aae96a3
SHA51240cc6d6c339ada3d5345e4472d9c0301c037c91273080bee2e498a78b83021a0b6b0686f8195217a835e3d6ed27f4d762f7f6035d227f2b1e0074bb39eae238d
-
\Users\Admin\AppData\Roaming\20jp17Kv.exeFilesize
13.9MB
MD5443785bf8b874e307b89db380dfeb164
SHA1525093ccff5a03c0a5e56e55628071a47d5be33c
SHA256dd08c49d2c91b7f446c231a6ede439fdf632d7d2f4dc4ad4ab52276b4aae96a3
SHA51240cc6d6c339ada3d5345e4472d9c0301c037c91273080bee2e498a78b83021a0b6b0686f8195217a835e3d6ed27f4d762f7f6035d227f2b1e0074bb39eae238d
-
\Users\Admin\AppData\Roaming\Q0f87tGn.exeFilesize
3.4MB
MD59d6aaaec5ec0840090a7222dfb214c00
SHA1bb5ccf4d5867adf1ece660aa55f8c758d2794b15
SHA256591587d25331629921749f7d8fc2dd4e4a1221cacc4f89bb81fe6f7f1dd448ac
SHA5129aa889111232e4c8b65a37640f93e82992950fa886394b0023311dae251b753ad5026e0a25c49ec73dbd2c6f9d89713d02e590af7566da12ef164ccaa0ab5752
-
\Users\Admin\AppData\Roaming\Q0f87tGn.exeFilesize
3.4MB
MD59d6aaaec5ec0840090a7222dfb214c00
SHA1bb5ccf4d5867adf1ece660aa55f8c758d2794b15
SHA256591587d25331629921749f7d8fc2dd4e4a1221cacc4f89bb81fe6f7f1dd448ac
SHA5129aa889111232e4c8b65a37640f93e82992950fa886394b0023311dae251b753ad5026e0a25c49ec73dbd2c6f9d89713d02e590af7566da12ef164ccaa0ab5752
-
memory/1248-108-0x00000000009F0000-0x0000000001840000-memory.dmpFilesize
14.3MB
-
memory/1868-133-0x000000013FEA0000-0x00000001403BF000-memory.dmpFilesize
5.1MB
-
memory/1868-134-0x000000013FEA0000-0x00000001403BF000-memory.dmpFilesize
5.1MB
-
memory/1868-135-0x000000013FEA0000-0x00000001403BF000-memory.dmpFilesize
5.1MB
-
memory/1868-136-0x000000013FEA0000-0x00000001403BF000-memory.dmpFilesize
5.1MB
-
memory/1900-114-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/1900-121-0x0000000004BA0000-0x0000000004BE0000-memory.dmpFilesize
256KB
-
memory/1900-120-0x0000000004BA0000-0x0000000004BE0000-memory.dmpFilesize
256KB
-
memory/1900-119-0x0000000004BA0000-0x0000000004BE0000-memory.dmpFilesize
256KB
-
memory/1900-118-0x0000000004BA0000-0x0000000004BE0000-memory.dmpFilesize
256KB
-
memory/1900-117-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1900-116-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1900-131-0x0000000008440000-0x000000000895F000-memory.dmpFilesize
5.1MB
-
memory/1900-132-0x0000000008440000-0x000000000895F000-memory.dmpFilesize
5.1MB
-
memory/1900-110-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1900-109-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/2000-54-0x0000000000400000-0x000000000091F000-memory.dmpFilesize
5.1MB
-
memory/2000-99-0x0000000061E00000-0x0000000061EF1000-memory.dmpFilesize
964KB