Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
22-11-2023 04:49
Static task
static1
Behavioral task
behavioral1
Sample
305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe
Resource
win7-20231023-en
windows7-x64
5 signatures
300 seconds
General
-
Target
305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe
-
Size
1001KB
-
MD5
2f9b3ebf19b5ad8781df519868710318
-
SHA1
7501b719d04879b4adf918d07a621c6497494193
-
SHA256
305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890
-
SHA512
2b338fc86ed6ad97c09227d27f9be3c013896d77ff93e61126bf6ad19ffe9cffb44cc26ca5f6290d8bfdf7c3850dfa8dd9f9f47d3dee2c4ff6b3e83d90da168c
-
SSDEEP
12288:sYv+YQwNb+zZtoDwjT8ACMJHmfrumiNLZZZlYY+0ASM4tuSL24RBVaA:h1Nb+z/oDwjTXHASfNLZZZlYY+wM4xeA
Malware Config
Signatures
-
Raccoon Stealer payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2996-3-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon behavioral1/memory/2996-5-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon behavioral1/memory/2996-7-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon behavioral1/memory/2996-9-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon -
Suspicious use of SetThreadContext 1 IoCs
Processes:
305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exedescription pid process target process PID 2204 set thread context of 2996 2204 305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2684 2996 WerFault.exe AppLaunch.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exeAppLaunch.exedescription pid process target process PID 2204 wrote to memory of 2996 2204 305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe AppLaunch.exe PID 2204 wrote to memory of 2996 2204 305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe AppLaunch.exe PID 2204 wrote to memory of 2996 2204 305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe AppLaunch.exe PID 2204 wrote to memory of 2996 2204 305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe AppLaunch.exe PID 2204 wrote to memory of 2996 2204 305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe AppLaunch.exe PID 2204 wrote to memory of 2996 2204 305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe AppLaunch.exe PID 2204 wrote to memory of 2996 2204 305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe AppLaunch.exe PID 2204 wrote to memory of 2996 2204 305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe AppLaunch.exe PID 2204 wrote to memory of 2996 2204 305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe AppLaunch.exe PID 2204 wrote to memory of 2996 2204 305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe AppLaunch.exe PID 2204 wrote to memory of 2996 2204 305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe AppLaunch.exe PID 2204 wrote to memory of 2996 2204 305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe AppLaunch.exe PID 2996 wrote to memory of 2684 2996 AppLaunch.exe WerFault.exe PID 2996 wrote to memory of 2684 2996 AppLaunch.exe WerFault.exe PID 2996 wrote to memory of 2684 2996 AppLaunch.exe WerFault.exe PID 2996 wrote to memory of 2684 2996 AppLaunch.exe WerFault.exe PID 2996 wrote to memory of 2684 2996 AppLaunch.exe WerFault.exe PID 2996 wrote to memory of 2684 2996 AppLaunch.exe WerFault.exe PID 2996 wrote to memory of 2684 2996 AppLaunch.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe"C:\Users\Admin\AppData\Local\Temp\305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 1963⤵
- Program crash
PID:2684