Analysis

  • max time kernel
    188s
  • max time network
    297s
  • platform
    windows10-1703_x64
  • resource
    win10-20231025-en
  • resource tags

    arch:x64arch:x86image:win10-20231025-enlocale:en-usos:windows10-1703-x64system
  • submitted
    26-11-2023 22:36

General

  • Target

    de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe

  • Size

    1.8MB

  • MD5

    fac406eb3a620ec45654e087f68ccd9e

  • SHA1

    02c21bd71ec411685102670cd4342a332ebaade0

  • SHA256

    de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340

  • SHA512

    2668c162ccc01f61a1a9ffec6b35a0c2f64b6f0f5a724f1563b3b23460ed17faa7e64d6817f0eaf7f9c38f3a1ac4fb730351d197b9fff051f25d6e1aac4d2b11

  • SSDEEP

    24576:fzzt1HHoz4LbaEz0qd++N2B4cIs1A6HukXhp3HHuTZiF2AVgKOpVftJi:fzzHXLWqp4ejqj3nUiF2A+TpVFJi

Malware Config

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • Raccoon Stealer payload 2 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe
    "C:\Users\Admin\AppData\Local\Temp\de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2732
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4924
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2072
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      2⤵
        PID:4868

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2072-26-0x0000000000400000-0x000000000045A000-memory.dmp

      Filesize

      360KB

    • memory/2072-43-0x0000000073AC0000-0x00000000741AE000-memory.dmp

      Filesize

      6.9MB

    • memory/2072-41-0x0000000009FD0000-0x0000000009FEE000-memory.dmp

      Filesize

      120KB

    • memory/2072-40-0x000000000A7B0000-0x000000000ACDC000-memory.dmp

      Filesize

      5.2MB

    • memory/2072-39-0x000000000A0B0000-0x000000000A272000-memory.dmp

      Filesize

      1.8MB

    • memory/2072-38-0x0000000009D60000-0x0000000009DD6000-memory.dmp

      Filesize

      472KB

    • memory/2072-37-0x0000000009C90000-0x0000000009CE0000-memory.dmp

      Filesize

      320KB

    • memory/2072-36-0x0000000008060000-0x00000000080C6000-memory.dmp

      Filesize

      408KB

    • memory/2072-35-0x0000000007870000-0x00000000078BB000-memory.dmp

      Filesize

      300KB

    • memory/2072-34-0x0000000007830000-0x000000000786E000-memory.dmp

      Filesize

      248KB

    • memory/2072-33-0x0000000007900000-0x0000000007A0A000-memory.dmp

      Filesize

      1.0MB

    • memory/2072-32-0x00000000077D0000-0x00000000077E2000-memory.dmp

      Filesize

      72KB

    • memory/2072-31-0x0000000008570000-0x0000000008B76000-memory.dmp

      Filesize

      6.0MB

    • memory/2072-30-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

      Filesize

      64KB

    • memory/2072-29-0x0000000073AC0000-0x00000000741AE000-memory.dmp

      Filesize

      6.9MB

    • memory/2732-10-0x0000000073AC0000-0x00000000741AE000-memory.dmp

      Filesize

      6.9MB

    • memory/2732-5-0x0000000006070000-0x00000000060B4000-memory.dmp

      Filesize

      272KB

    • memory/2732-2-0x0000000073AC0000-0x00000000741AE000-memory.dmp

      Filesize

      6.9MB

    • memory/2732-18-0x0000000005560000-0x0000000005570000-memory.dmp

      Filesize

      64KB

    • memory/2732-1-0x00000000053C0000-0x000000000545C000-memory.dmp

      Filesize

      624KB

    • memory/2732-3-0x0000000005A70000-0x0000000005F6E000-memory.dmp

      Filesize

      5.0MB

    • memory/2732-4-0x0000000005560000-0x0000000005570000-memory.dmp

      Filesize

      64KB

    • memory/2732-11-0x0000000005560000-0x0000000005570000-memory.dmp

      Filesize

      64KB

    • memory/2732-6-0x0000000006180000-0x0000000006212000-memory.dmp

      Filesize

      584KB

    • memory/2732-25-0x0000000073AC0000-0x00000000741AE000-memory.dmp

      Filesize

      6.9MB

    • memory/2732-7-0x0000000006100000-0x000000000610A000-memory.dmp

      Filesize

      40KB

    • memory/2732-8-0x0000000007910000-0x000000000792A000-memory.dmp

      Filesize

      104KB

    • memory/2732-14-0x0000000005560000-0x0000000005570000-memory.dmp

      Filesize

      64KB

    • memory/2732-9-0x0000000006780000-0x0000000006786000-memory.dmp

      Filesize

      24KB

    • memory/2732-0-0x0000000000940000-0x0000000000B08000-memory.dmp

      Filesize

      1.8MB

    • memory/4868-22-0x0000000000400000-0x0000000000416000-memory.dmp

      Filesize

      88KB

    • memory/4868-24-0x0000000000400000-0x0000000000416000-memory.dmp

      Filesize

      88KB

    • memory/4924-12-0x0000000000400000-0x00000000004CE000-memory.dmp

      Filesize

      824KB

    • memory/4924-13-0x0000000000400000-0x00000000004CE000-memory.dmp

      Filesize

      824KB

    • memory/4924-28-0x0000000073AC0000-0x00000000741AE000-memory.dmp

      Filesize

      6.9MB

    • memory/4924-15-0x0000000073AC0000-0x00000000741AE000-memory.dmp

      Filesize

      6.9MB

    • memory/4924-16-0x0000000005420000-0x0000000005430000-memory.dmp

      Filesize

      64KB

    • memory/4924-21-0x0000000005420000-0x0000000005430000-memory.dmp

      Filesize

      64KB

    • memory/4924-20-0x0000000005420000-0x0000000005430000-memory.dmp

      Filesize

      64KB

    • memory/4924-19-0x0000000073AC0000-0x00000000741AE000-memory.dmp

      Filesize

      6.9MB

    • memory/4924-17-0x0000000005420000-0x0000000005430000-memory.dmp

      Filesize

      64KB