Analysis
-
max time kernel
149s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2023 10:50
Static task
static1
Behavioral task
behavioral1
Sample
0d0bfea25b921d11907d61def9e94c6e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0d0bfea25b921d11907d61def9e94c6e.exe
Resource
win10v2004-20231215-en
General
-
Target
0d0bfea25b921d11907d61def9e94c6e.exe
-
Size
1.0MB
-
MD5
0d0bfea25b921d11907d61def9e94c6e
-
SHA1
b97bb93555740b6fd473983e35585a7c1ad3d427
-
SHA256
b9acbe3e107eb4dd11e9fcaef4ec4f394cf1cbb017a57193786ba03c6f8fd0db
-
SHA512
b638d5cfa99e904ac200ada18e7cb9278ed94f35968fd458824eb4007ff18a954f70552c0177483f524157fe68393673f681f9908b76dfc1f98456e0cfecb68f
-
SSDEEP
24576:IlE2q8MnAWRpnwU9QtTJaur6Syt4VhkFha1OIgImZk3xk5npFhkF96x5hkFYelf:2EeKTqtN7r7VV0VIm0yRpF0I0d
Malware Config
Extracted
raccoon
1.8.1
e16d9c3413a8d3bc552d87560e5a14148908608d
-
url4cnc
https://t.me/brikitiki
Extracted
azorult
http://195.245.112.115/index.php
Extracted
oski
milsom.ug
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Raccoon Stealer V1 payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/3140-33-0x0000000000400000-0x0000000000497000-memory.dmp family_raccoon_v1 behavioral2/memory/3140-34-0x0000000000400000-0x0000000000497000-memory.dmp family_raccoon_v1 behavioral2/memory/3140-35-0x0000000000400000-0x0000000000497000-memory.dmp family_raccoon_v1 behavioral2/memory/3140-59-0x0000000000400000-0x0000000000497000-memory.dmp family_raccoon_v1 behavioral2/memory/3140-60-0x0000000000400000-0x0000000000493000-memory.dmp family_raccoon_v1 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0d0bfea25b921d11907d61def9e94c6e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation 0d0bfea25b921d11907d61def9e94c6e.exe -
Executes dropped EXE 4 IoCs
Processes:
ssme.exefaame.exessme.exefaame.exepid process 684 ssme.exe 1772 faame.exe 3396 ssme.exe 656 faame.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
0d0bfea25b921d11907d61def9e94c6e.exessme.exefaame.exedescription pid process target process PID 1060 set thread context of 3140 1060 0d0bfea25b921d11907d61def9e94c6e.exe 0d0bfea25b921d11907d61def9e94c6e.exe PID 684 set thread context of 3396 684 ssme.exe ssme.exe PID 1772 set thread context of 656 1772 faame.exe faame.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1376 656 WerFault.exe faame.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
0d0bfea25b921d11907d61def9e94c6e.exessme.exefaame.exepid process 1060 0d0bfea25b921d11907d61def9e94c6e.exe 684 ssme.exe 1772 faame.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
0d0bfea25b921d11907d61def9e94c6e.exessme.exefaame.exepid process 1060 0d0bfea25b921d11907d61def9e94c6e.exe 684 ssme.exe 1772 faame.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
0d0bfea25b921d11907d61def9e94c6e.exessme.exefaame.exedescription pid process target process PID 1060 wrote to memory of 684 1060 0d0bfea25b921d11907d61def9e94c6e.exe ssme.exe PID 1060 wrote to memory of 684 1060 0d0bfea25b921d11907d61def9e94c6e.exe ssme.exe PID 1060 wrote to memory of 684 1060 0d0bfea25b921d11907d61def9e94c6e.exe ssme.exe PID 1060 wrote to memory of 1772 1060 0d0bfea25b921d11907d61def9e94c6e.exe faame.exe PID 1060 wrote to memory of 1772 1060 0d0bfea25b921d11907d61def9e94c6e.exe faame.exe PID 1060 wrote to memory of 1772 1060 0d0bfea25b921d11907d61def9e94c6e.exe faame.exe PID 1060 wrote to memory of 3140 1060 0d0bfea25b921d11907d61def9e94c6e.exe 0d0bfea25b921d11907d61def9e94c6e.exe PID 1060 wrote to memory of 3140 1060 0d0bfea25b921d11907d61def9e94c6e.exe 0d0bfea25b921d11907d61def9e94c6e.exe PID 1060 wrote to memory of 3140 1060 0d0bfea25b921d11907d61def9e94c6e.exe 0d0bfea25b921d11907d61def9e94c6e.exe PID 1060 wrote to memory of 3140 1060 0d0bfea25b921d11907d61def9e94c6e.exe 0d0bfea25b921d11907d61def9e94c6e.exe PID 684 wrote to memory of 3396 684 ssme.exe ssme.exe PID 684 wrote to memory of 3396 684 ssme.exe ssme.exe PID 684 wrote to memory of 3396 684 ssme.exe ssme.exe PID 684 wrote to memory of 3396 684 ssme.exe ssme.exe PID 1772 wrote to memory of 656 1772 faame.exe faame.exe PID 1772 wrote to memory of 656 1772 faame.exe faame.exe PID 1772 wrote to memory of 656 1772 faame.exe faame.exe PID 1772 wrote to memory of 656 1772 faame.exe faame.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d0bfea25b921d11907d61def9e94c6e.exe"C:\Users\Admin\AppData\Local\Temp\0d0bfea25b921d11907d61def9e94c6e.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ssme.exe"C:\Users\Admin\AppData\Local\Temp\ssme.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ssme.exe"C:\Users\Admin\AppData\Local\Temp\ssme.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\faame.exe"C:\Users\Admin\AppData\Local\Temp\faame.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\faame.exe"C:\Users\Admin\AppData\Local\Temp\faame.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 13044⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\0d0bfea25b921d11907d61def9e94c6e.exe"C:\Users\Admin\AppData\Local\Temp\0d0bfea25b921d11907d61def9e94c6e.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 656 -ip 6561⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\faame.exeFilesize
276KB
MD52618de7ce265814bb7c9db2d040a648c
SHA18124cdb548ade9b39c84cc3d87de270e46bd0496
SHA2560ee0befc1f8446bc1a86d0c18ad5674520c779434eb3a78ea0d64be1ef5d7622
SHA512925e1a29e20bd343132b465504245643f6fc345bd42cc75944278a6559e919dabf606e8b56a36ca3aec2780c12981065ffa08f273adfe828084758af3702e253
-
C:\Users\Admin\AppData\Local\Temp\ssme.exeFilesize
228KB
MD559337e167d10c145b4907027b618ae62
SHA18a7b0f563297f060a8f2cbcc32b8bac7028bbd6b
SHA256b22e796ca4e1031b444aafbcd498fefe0cbc1f6fd37334090529be8c9bc14cf4
SHA51240ceae1055f7cf9bb9068c84bb7b29a37eb4720fa30de709e82a96335a2c71b8a58a51b2543b277b4d2b6362339280f6dc5dd7000247589b2d75692cad7c6e52
-
memory/656-54-0x00000000005F0000-0x00000000005F1000-memory.dmpFilesize
4KB
-
memory/656-53-0x0000000077DF2000-0x0000000077DF3000-memory.dmpFilesize
4KB
-
memory/656-51-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/656-50-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/656-58-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/656-48-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/656-57-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/684-28-0x0000000001FA0000-0x0000000001FA1000-memory.dmpFilesize
4KB
-
memory/1060-3-0x0000000000B00000-0x0000000000B01000-memory.dmpFilesize
4KB
-
memory/1060-32-0x0000000003650000-0x0000000003657000-memory.dmpFilesize
28KB
-
memory/1060-2-0x0000000077DF2000-0x0000000077DF3000-memory.dmpFilesize
4KB
-
memory/1772-31-0x00000000020C0000-0x00000000020C1000-memory.dmpFilesize
4KB
-
memory/3140-59-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/3140-60-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/3140-37-0x0000000077DF2000-0x0000000077DF3000-memory.dmpFilesize
4KB
-
memory/3140-38-0x0000000000600000-0x0000000000601000-memory.dmpFilesize
4KB
-
memory/3140-35-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/3140-34-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/3140-33-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/3396-39-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/3396-47-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3396-46-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/3396-45-0x0000000000590000-0x0000000000591000-memory.dmpFilesize
4KB
-
memory/3396-44-0x0000000077DF2000-0x0000000077DF3000-memory.dmpFilesize
4KB
-
memory/3396-42-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB