Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
25/10/2023, 05:57
Behavioral task
behavioral1
Sample
e2ff8a34d2fcc417c41c822e4f3ea271.bin.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
e2ff8a34d2fcc417c41c822e4f3ea271.bin.exe
Resource
win10v2004-20231020-en
General
-
Target
e2ff8a34d2fcc417c41c822e4f3ea271.bin.exe
-
Size
3.9MB
-
MD5
e2ff8a34d2fcc417c41c822e4f3ea271
-
SHA1
926eaf9dd645e164e9f06ddcba567568b3b8bb1b
-
SHA256
4f26511d40ad3d781ff1bd4c643f9418b3fd0c4da6b769a1ff9ae4d07d8892d0
-
SHA512
823d99704b761218b3de8f6b107378b529e7f718557b9e2b57ffb497310c4eccfc35c402bad28cdc2758ef254e55a936949c24468f07fc21e7e3efc0671beec2
-
SSDEEP
49152:Vtdn87lWy7rOwZxf8xjptLZMLGPQqXRYAc/yvenXAo/koTl:h85Wy7rBlqpBZ/xXRC6WXAo/pl
Malware Config
Extracted
raccoon
6a6a005b9aa778f606280c5fa24ae595
http://195.123.218.98:80
http://31.192.23
-
user_agent
SunShineMoonLight
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule behavioral1/memory/2248-0-0x0000000000870000-0x0000000000C50000-memory.dmp family_zgrat_v1 -
Raccoon Stealer payload 5 IoCs
resource yara_rule behavioral1/memory/2820-27-0x0000000000400000-0x000000000041B000-memory.dmp family_raccoon behavioral1/memory/2820-30-0x0000000000400000-0x000000000041B000-memory.dmp family_raccoon behavioral1/memory/2820-32-0x0000000000400000-0x000000000041B000-memory.dmp family_raccoon behavioral1/memory/2820-35-0x0000000000400000-0x000000000041B000-memory.dmp family_raccoon behavioral1/memory/2820-36-0x0000000000400000-0x000000000041B000-memory.dmp family_raccoon -
Loads dropped DLL 1 IoCs
pid Process 2248 e2ff8a34d2fcc417c41c822e4f3ea271.bin.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2248 set thread context of 2820 2248 e2ff8a34d2fcc417c41c822e4f3ea271.bin.exe 28 -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2820 2248 e2ff8a34d2fcc417c41c822e4f3ea271.bin.exe 28 PID 2248 wrote to memory of 2820 2248 e2ff8a34d2fcc417c41c822e4f3ea271.bin.exe 28 PID 2248 wrote to memory of 2820 2248 e2ff8a34d2fcc417c41c822e4f3ea271.bin.exe 28 PID 2248 wrote to memory of 2820 2248 e2ff8a34d2fcc417c41c822e4f3ea271.bin.exe 28 PID 2248 wrote to memory of 2820 2248 e2ff8a34d2fcc417c41c822e4f3ea271.bin.exe 28 PID 2248 wrote to memory of 2820 2248 e2ff8a34d2fcc417c41c822e4f3ea271.bin.exe 28 PID 2248 wrote to memory of 2820 2248 e2ff8a34d2fcc417c41c822e4f3ea271.bin.exe 28 PID 2248 wrote to memory of 2820 2248 e2ff8a34d2fcc417c41c822e4f3ea271.bin.exe 28 PID 2248 wrote to memory of 2820 2248 e2ff8a34d2fcc417c41c822e4f3ea271.bin.exe 28 PID 2248 wrote to memory of 2820 2248 e2ff8a34d2fcc417c41c822e4f3ea271.bin.exe 28 PID 2248 wrote to memory of 2820 2248 e2ff8a34d2fcc417c41c822e4f3ea271.bin.exe 28 PID 2248 wrote to memory of 2820 2248 e2ff8a34d2fcc417c41c822e4f3ea271.bin.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2ff8a34d2fcc417c41c822e4f3ea271.bin.exe"C:\Users\Admin\AppData\Local\Temp\e2ff8a34d2fcc417c41c822e4f3ea271.bin.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2820
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
742KB
MD5544cd51a596619b78e9b54b70088307d
SHA14769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719