Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/10/2023, 05:57

General

  • Target

    e2ff8a34d2fcc417c41c822e4f3ea271.bin.exe

  • Size

    3.9MB

  • MD5

    e2ff8a34d2fcc417c41c822e4f3ea271

  • SHA1

    926eaf9dd645e164e9f06ddcba567568b3b8bb1b

  • SHA256

    4f26511d40ad3d781ff1bd4c643f9418b3fd0c4da6b769a1ff9ae4d07d8892d0

  • SHA512

    823d99704b761218b3de8f6b107378b529e7f718557b9e2b57ffb497310c4eccfc35c402bad28cdc2758ef254e55a936949c24468f07fc21e7e3efc0671beec2

  • SSDEEP

    49152:Vtdn87lWy7rOwZxf8xjptLZMLGPQqXRYAc/yvenXAo/koTl:h85Wy7rBlqpBZ/xXRC6WXAo/pl

Malware Config

Extracted

Family

raccoon

Botnet

6a6a005b9aa778f606280c5fa24ae595

C2

http://195.123.218.98:80

http://31.192.23

Attributes
  • user_agent

    SunShineMoonLight

xor.plain

Signatures

  • Detect ZGRat V1 1 IoCs
  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • Raccoon Stealer payload 3 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e2ff8a34d2fcc417c41c822e4f3ea271.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\e2ff8a34d2fcc417c41c822e4f3ea271.bin.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4976
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:2964
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
          PID:4044
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 572
            3⤵
            • Program crash
            PID:3912
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4044 -ip 4044
        1⤵
          PID:4016

        Network

              MITRE ATT&CK Matrix

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

                Filesize

                742KB

                MD5

                544cd51a596619b78e9b54b70088307d

                SHA1

                4769ddd2dbc1dc44b758964ed0bd231b85880b65

                SHA256

                dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

                SHA512

                f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

              • memory/4044-27-0x0000000000400000-0x000000000041B000-memory.dmp

                Filesize

                108KB

              • memory/4044-25-0x0000000000400000-0x000000000041B000-memory.dmp

                Filesize

                108KB

              • memory/4044-21-0x0000000000400000-0x000000000041B000-memory.dmp

                Filesize

                108KB

              • memory/4976-14-0x00000000057C0000-0x00000000057D0000-memory.dmp

                Filesize

                64KB

              • memory/4976-17-0x00000000057C0000-0x00000000057D0000-memory.dmp

                Filesize

                64KB

              • memory/4976-6-0x00000000057D0000-0x0000000005962000-memory.dmp

                Filesize

                1.6MB

              • memory/4976-4-0x0000000003090000-0x000000000309A000-memory.dmp

                Filesize

                40KB

              • memory/4976-12-0x00000000057C0000-0x00000000057D0000-memory.dmp

                Filesize

                64KB

              • memory/4976-13-0x00000000057C0000-0x00000000057D0000-memory.dmp

                Filesize

                64KB

              • memory/4976-0-0x0000000075290000-0x0000000075A40000-memory.dmp

                Filesize

                7.7MB

              • memory/4976-15-0x0000000005770000-0x0000000005780000-memory.dmp

                Filesize

                64KB

              • memory/4976-16-0x00000000057C0000-0x00000000057D0000-memory.dmp

                Filesize

                64KB

              • memory/4976-5-0x0000000005500000-0x0000000005508000-memory.dmp

                Filesize

                32KB

              • memory/4976-18-0x0000000005EE0000-0x0000000005FE0000-memory.dmp

                Filesize

                1024KB

              • memory/4976-19-0x0000000005EE0000-0x0000000005FE0000-memory.dmp

                Filesize

                1024KB

              • memory/4976-20-0x0000000005EE0000-0x0000000005FE0000-memory.dmp

                Filesize

                1024KB

              • memory/4976-3-0x0000000075290000-0x0000000075A40000-memory.dmp

                Filesize

                7.7MB

              • memory/4976-23-0x0000000075290000-0x0000000075A40000-memory.dmp

                Filesize

                7.7MB

              • memory/4976-2-0x0000000005630000-0x00000000056CC000-memory.dmp

                Filesize

                624KB

              • memory/4976-1-0x0000000000800000-0x0000000000BE0000-memory.dmp

                Filesize

                3.9MB