Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    25/10/2023, 05:57

General

  • Target

    e2ff8a34d2fcc417c41c822e4f3ea271.bin.exe

  • Size

    3.9MB

  • MD5

    e2ff8a34d2fcc417c41c822e4f3ea271

  • SHA1

    926eaf9dd645e164e9f06ddcba567568b3b8bb1b

  • SHA256

    4f26511d40ad3d781ff1bd4c643f9418b3fd0c4da6b769a1ff9ae4d07d8892d0

  • SHA512

    823d99704b761218b3de8f6b107378b529e7f718557b9e2b57ffb497310c4eccfc35c402bad28cdc2758ef254e55a936949c24468f07fc21e7e3efc0671beec2

  • SSDEEP

    49152:Vtdn87lWy7rOwZxf8xjptLZMLGPQqXRYAc/yvenXAo/koTl:h85Wy7rBlqpBZ/xXRC6WXAo/pl

Malware Config

Extracted

Family

raccoon

Botnet

6a6a005b9aa778f606280c5fa24ae595

C2

http://195.123.218.98:80

http://31.192.23

Attributes
  • user_agent

    SunShineMoonLight

xor.plain

Signatures

  • Detect ZGRat V1 1 IoCs
  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • Raccoon Stealer payload 5 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e2ff8a34d2fcc417c41c822e4f3ea271.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\e2ff8a34d2fcc417c41c822e4f3ea271.bin.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:2820

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • \Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

            Filesize

            742KB

            MD5

            544cd51a596619b78e9b54b70088307d

            SHA1

            4769ddd2dbc1dc44b758964ed0bd231b85880b65

            SHA256

            dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

            SHA512

            f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

          • memory/2248-17-0x00000000026B0000-0x00000000026F0000-memory.dmp

            Filesize

            256KB

          • memory/2248-13-0x00000000003D0000-0x00000000003E0000-memory.dmp

            Filesize

            64KB

          • memory/2248-3-0x0000000000200000-0x000000000020A000-memory.dmp

            Filesize

            40KB

          • memory/2248-4-0x0000000000310000-0x0000000000318000-memory.dmp

            Filesize

            32KB

          • memory/2248-18-0x00000000057A0000-0x00000000058A0000-memory.dmp

            Filesize

            1024KB

          • memory/2248-0-0x0000000000870000-0x0000000000C50000-memory.dmp

            Filesize

            3.9MB

          • memory/2248-10-0x00000000026B0000-0x00000000026F0000-memory.dmp

            Filesize

            256KB

          • memory/2248-11-0x00000000026B0000-0x00000000026F0000-memory.dmp

            Filesize

            256KB

          • memory/2248-12-0x00000000026B0000-0x00000000026F0000-memory.dmp

            Filesize

            256KB

          • memory/2248-1-0x0000000074B50000-0x000000007523E000-memory.dmp

            Filesize

            6.9MB

          • memory/2248-14-0x00000000026B0000-0x00000000026F0000-memory.dmp

            Filesize

            256KB

          • memory/2248-16-0x00000000026B0000-0x00000000026F0000-memory.dmp

            Filesize

            256KB

          • memory/2248-2-0x0000000074B50000-0x000000007523E000-memory.dmp

            Filesize

            6.9MB

          • memory/2248-15-0x00000000026B0000-0x00000000026F0000-memory.dmp

            Filesize

            256KB

          • memory/2248-5-0x0000000004D60000-0x0000000004EF2000-memory.dmp

            Filesize

            1.6MB

          • memory/2248-19-0x00000000026B0000-0x00000000026F0000-memory.dmp

            Filesize

            256KB

          • memory/2248-20-0x00000000026B0000-0x00000000026F0000-memory.dmp

            Filesize

            256KB

          • memory/2248-21-0x00000000026B0000-0x00000000026F0000-memory.dmp

            Filesize

            256KB

          • memory/2248-33-0x0000000074B50000-0x000000007523E000-memory.dmp

            Filesize

            6.9MB

          • memory/2820-30-0x0000000000400000-0x000000000041B000-memory.dmp

            Filesize

            108KB

          • memory/2820-26-0x0000000000400000-0x000000000041B000-memory.dmp

            Filesize

            108KB

          • memory/2820-27-0x0000000000400000-0x000000000041B000-memory.dmp

            Filesize

            108KB

          • memory/2820-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/2820-24-0x0000000000400000-0x000000000041B000-memory.dmp

            Filesize

            108KB

          • memory/2820-32-0x0000000000400000-0x000000000041B000-memory.dmp

            Filesize

            108KB

          • memory/2820-22-0x0000000000400000-0x000000000041B000-memory.dmp

            Filesize

            108KB

          • memory/2820-35-0x0000000000400000-0x000000000041B000-memory.dmp

            Filesize

            108KB

          • memory/2820-36-0x0000000000400000-0x000000000041B000-memory.dmp

            Filesize

            108KB