Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19-12-2023 10:50
Static task
static1
Behavioral task
behavioral1
Sample
0d0bfea25b921d11907d61def9e94c6e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0d0bfea25b921d11907d61def9e94c6e.exe
Resource
win10v2004-20231215-en
General
-
Target
0d0bfea25b921d11907d61def9e94c6e.exe
-
Size
1.0MB
-
MD5
0d0bfea25b921d11907d61def9e94c6e
-
SHA1
b97bb93555740b6fd473983e35585a7c1ad3d427
-
SHA256
b9acbe3e107eb4dd11e9fcaef4ec4f394cf1cbb017a57193786ba03c6f8fd0db
-
SHA512
b638d5cfa99e904ac200ada18e7cb9278ed94f35968fd458824eb4007ff18a954f70552c0177483f524157fe68393673f681f9908b76dfc1f98456e0cfecb68f
-
SSDEEP
24576:IlE2q8MnAWRpnwU9QtTJaur6Syt4VhkFha1OIgImZk3xk5npFhkF96x5hkFYelf:2EeKTqtN7r7VV0VIm0yRpF0I0d
Malware Config
Extracted
raccoon
1.8.1
e16d9c3413a8d3bc552d87560e5a14148908608d
-
url4cnc
https://t.me/brikitiki
Extracted
oski
milsom.ug
Extracted
azorult
http://195.245.112.115/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Raccoon Stealer V1 payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2992-26-0x0000000000400000-0x0000000000497000-memory.dmp family_raccoon_v1 behavioral1/memory/2992-41-0x0000000000400000-0x0000000000497000-memory.dmp family_raccoon_v1 behavioral1/memory/2992-44-0x0000000000400000-0x0000000000497000-memory.dmp family_raccoon_v1 behavioral1/memory/2992-50-0x0000000000400000-0x0000000000493000-memory.dmp family_raccoon_v1 behavioral1/memory/2992-52-0x0000000000400000-0x0000000000497000-memory.dmp family_raccoon_v1 -
Executes dropped EXE 4 IoCs
Processes:
ssme.exefaame.exessme.exefaame.exepid process 2964 ssme.exe 2248 faame.exe 2732 ssme.exe 2680 faame.exe -
Loads dropped DLL 11 IoCs
Processes:
0d0bfea25b921d11907d61def9e94c6e.exessme.exefaame.exeWerFault.exepid process 1696 0d0bfea25b921d11907d61def9e94c6e.exe 1696 0d0bfea25b921d11907d61def9e94c6e.exe 1696 0d0bfea25b921d11907d61def9e94c6e.exe 1696 0d0bfea25b921d11907d61def9e94c6e.exe 2964 ssme.exe 2248 faame.exe 2924 WerFault.exe 2924 WerFault.exe 2924 WerFault.exe 2924 WerFault.exe 2924 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
0d0bfea25b921d11907d61def9e94c6e.exessme.exefaame.exedescription pid process target process PID 1696 set thread context of 2992 1696 0d0bfea25b921d11907d61def9e94c6e.exe 0d0bfea25b921d11907d61def9e94c6e.exe PID 2964 set thread context of 2732 2964 ssme.exe ssme.exe PID 2248 set thread context of 2680 2248 faame.exe faame.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2924 2680 WerFault.exe faame.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
0d0bfea25b921d11907d61def9e94c6e.exessme.exefaame.exepid process 1696 0d0bfea25b921d11907d61def9e94c6e.exe 2964 ssme.exe 2248 faame.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
0d0bfea25b921d11907d61def9e94c6e.exessme.exefaame.exepid process 1696 0d0bfea25b921d11907d61def9e94c6e.exe 2964 ssme.exe 2248 faame.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
0d0bfea25b921d11907d61def9e94c6e.exessme.exefaame.exefaame.exedescription pid process target process PID 1696 wrote to memory of 2964 1696 0d0bfea25b921d11907d61def9e94c6e.exe ssme.exe PID 1696 wrote to memory of 2964 1696 0d0bfea25b921d11907d61def9e94c6e.exe ssme.exe PID 1696 wrote to memory of 2964 1696 0d0bfea25b921d11907d61def9e94c6e.exe ssme.exe PID 1696 wrote to memory of 2964 1696 0d0bfea25b921d11907d61def9e94c6e.exe ssme.exe PID 1696 wrote to memory of 2248 1696 0d0bfea25b921d11907d61def9e94c6e.exe faame.exe PID 1696 wrote to memory of 2248 1696 0d0bfea25b921d11907d61def9e94c6e.exe faame.exe PID 1696 wrote to memory of 2248 1696 0d0bfea25b921d11907d61def9e94c6e.exe faame.exe PID 1696 wrote to memory of 2248 1696 0d0bfea25b921d11907d61def9e94c6e.exe faame.exe PID 1696 wrote to memory of 2992 1696 0d0bfea25b921d11907d61def9e94c6e.exe 0d0bfea25b921d11907d61def9e94c6e.exe PID 1696 wrote to memory of 2992 1696 0d0bfea25b921d11907d61def9e94c6e.exe 0d0bfea25b921d11907d61def9e94c6e.exe PID 1696 wrote to memory of 2992 1696 0d0bfea25b921d11907d61def9e94c6e.exe 0d0bfea25b921d11907d61def9e94c6e.exe PID 1696 wrote to memory of 2992 1696 0d0bfea25b921d11907d61def9e94c6e.exe 0d0bfea25b921d11907d61def9e94c6e.exe PID 1696 wrote to memory of 2992 1696 0d0bfea25b921d11907d61def9e94c6e.exe 0d0bfea25b921d11907d61def9e94c6e.exe PID 2964 wrote to memory of 2732 2964 ssme.exe ssme.exe PID 2964 wrote to memory of 2732 2964 ssme.exe ssme.exe PID 2964 wrote to memory of 2732 2964 ssme.exe ssme.exe PID 2964 wrote to memory of 2732 2964 ssme.exe ssme.exe PID 2248 wrote to memory of 2680 2248 faame.exe faame.exe PID 2248 wrote to memory of 2680 2248 faame.exe faame.exe PID 2248 wrote to memory of 2680 2248 faame.exe faame.exe PID 2248 wrote to memory of 2680 2248 faame.exe faame.exe PID 2964 wrote to memory of 2732 2964 ssme.exe ssme.exe PID 2248 wrote to memory of 2680 2248 faame.exe faame.exe PID 2680 wrote to memory of 2924 2680 faame.exe WerFault.exe PID 2680 wrote to memory of 2924 2680 faame.exe WerFault.exe PID 2680 wrote to memory of 2924 2680 faame.exe WerFault.exe PID 2680 wrote to memory of 2924 2680 faame.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d0bfea25b921d11907d61def9e94c6e.exe"C:\Users\Admin\AppData\Local\Temp\0d0bfea25b921d11907d61def9e94c6e.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ssme.exe"C:\Users\Admin\AppData\Local\Temp\ssme.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ssme.exe"C:\Users\Admin\AppData\Local\Temp\ssme.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\faame.exe"C:\Users\Admin\AppData\Local\Temp\faame.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\faame.exe"C:\Users\Admin\AppData\Local\Temp\faame.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 7724⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\0d0bfea25b921d11907d61def9e94c6e.exe"C:\Users\Admin\AppData\Local\Temp\0d0bfea25b921d11907d61def9e94c6e.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\faame.exeFilesize
276KB
MD52618de7ce265814bb7c9db2d040a648c
SHA18124cdb548ade9b39c84cc3d87de270e46bd0496
SHA2560ee0befc1f8446bc1a86d0c18ad5674520c779434eb3a78ea0d64be1ef5d7622
SHA512925e1a29e20bd343132b465504245643f6fc345bd42cc75944278a6559e919dabf606e8b56a36ca3aec2780c12981065ffa08f273adfe828084758af3702e253
-
\Users\Admin\AppData\Local\Temp\ssme.exeFilesize
228KB
MD559337e167d10c145b4907027b618ae62
SHA18a7b0f563297f060a8f2cbcc32b8bac7028bbd6b
SHA256b22e796ca4e1031b444aafbcd498fefe0cbc1f6fd37334090529be8c9bc14cf4
SHA51240ceae1055f7cf9bb9068c84bb7b29a37eb4720fa30de709e82a96335a2c71b8a58a51b2543b277b4d2b6362339280f6dc5dd7000247589b2d75692cad7c6e52
-
memory/1696-2-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1696-23-0x00000000025A0000-0x00000000025A7000-memory.dmpFilesize
28KB
-
memory/2248-36-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2680-61-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2680-37-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2680-60-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2680-51-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2680-45-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2732-48-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2732-40-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2732-31-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2732-46-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2732-49-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2964-32-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2992-50-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/2992-44-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/2992-52-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/2992-41-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/2992-26-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB