Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19-12-2023 21:08
Static task
static1
Behavioral task
behavioral1
Sample
9fbb8a90e9b971800f4bdb85e1bf8f7c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9fbb8a90e9b971800f4bdb85e1bf8f7c.exe
Resource
win10v2004-20231215-en
General
-
Target
9fbb8a90e9b971800f4bdb85e1bf8f7c.exe
-
Size
1.0MB
-
MD5
9fbb8a90e9b971800f4bdb85e1bf8f7c
-
SHA1
cf116f3df69bbb896f34f24d26c4573b14af2fe5
-
SHA256
b6afb4c2d094c9e803015e65043ee6a48bbf0e31bdd66963078ca1454195b1c6
-
SHA512
437907045e9a5af27db8a60db05780e72e60b58cc4949723d3f4b2b0d372aee13ed18335dec3ba33e32ae583046a9ef200eaf40df991746adf480bfda07be9f7
-
SSDEEP
24576:IlE2q8MnAWRpnwU9QtTJaur6Syt4VhkFha1OIgImZk3xk5npFhkF96x5hkFYelP:2EeKTqtN7r7VV0VIm0yRpF0I0N
Malware Config
Extracted
oski
milsom.ug
Extracted
azorult
http://195.245.112.115/index.php
Extracted
raccoon
1.8.1
e16d9c3413a8d3bc552d87560e5a14148908608d
-
url4cnc
https://t.me/brikitiki
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Raccoon Stealer V1 payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2796-29-0x0000000000400000-0x0000000000497000-memory.dmp family_raccoon_v1 behavioral1/memory/2796-43-0x0000000000400000-0x0000000000497000-memory.dmp family_raccoon_v1 behavioral1/memory/2796-50-0x0000000000400000-0x0000000000493000-memory.dmp family_raccoon_v1 behavioral1/memory/2796-58-0x0000000000400000-0x0000000000497000-memory.dmp family_raccoon_v1 -
Executes dropped EXE 4 IoCs
Processes:
ssme.exefaame.exessme.exefaame.exepid process 2160 ssme.exe 2644 faame.exe 2832 ssme.exe 2696 faame.exe -
Loads dropped DLL 11 IoCs
Processes:
9fbb8a90e9b971800f4bdb85e1bf8f7c.exessme.exefaame.exeWerFault.exepid process 2632 9fbb8a90e9b971800f4bdb85e1bf8f7c.exe 2632 9fbb8a90e9b971800f4bdb85e1bf8f7c.exe 2632 9fbb8a90e9b971800f4bdb85e1bf8f7c.exe 2632 9fbb8a90e9b971800f4bdb85e1bf8f7c.exe 2160 ssme.exe 2644 faame.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
9fbb8a90e9b971800f4bdb85e1bf8f7c.exessme.exefaame.exedescription pid process target process PID 2632 set thread context of 2796 2632 9fbb8a90e9b971800f4bdb85e1bf8f7c.exe 9fbb8a90e9b971800f4bdb85e1bf8f7c.exe PID 2160 set thread context of 2832 2160 ssme.exe ssme.exe PID 2644 set thread context of 2696 2644 faame.exe faame.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2952 2696 WerFault.exe faame.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
9fbb8a90e9b971800f4bdb85e1bf8f7c.exessme.exefaame.exepid process 2632 9fbb8a90e9b971800f4bdb85e1bf8f7c.exe 2160 ssme.exe 2644 faame.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
9fbb8a90e9b971800f4bdb85e1bf8f7c.exessme.exefaame.exepid process 2632 9fbb8a90e9b971800f4bdb85e1bf8f7c.exe 2160 ssme.exe 2644 faame.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
9fbb8a90e9b971800f4bdb85e1bf8f7c.exessme.exefaame.exefaame.exedescription pid process target process PID 2632 wrote to memory of 2160 2632 9fbb8a90e9b971800f4bdb85e1bf8f7c.exe ssme.exe PID 2632 wrote to memory of 2160 2632 9fbb8a90e9b971800f4bdb85e1bf8f7c.exe ssme.exe PID 2632 wrote to memory of 2160 2632 9fbb8a90e9b971800f4bdb85e1bf8f7c.exe ssme.exe PID 2632 wrote to memory of 2160 2632 9fbb8a90e9b971800f4bdb85e1bf8f7c.exe ssme.exe PID 2632 wrote to memory of 2644 2632 9fbb8a90e9b971800f4bdb85e1bf8f7c.exe faame.exe PID 2632 wrote to memory of 2644 2632 9fbb8a90e9b971800f4bdb85e1bf8f7c.exe faame.exe PID 2632 wrote to memory of 2644 2632 9fbb8a90e9b971800f4bdb85e1bf8f7c.exe faame.exe PID 2632 wrote to memory of 2644 2632 9fbb8a90e9b971800f4bdb85e1bf8f7c.exe faame.exe PID 2632 wrote to memory of 2796 2632 9fbb8a90e9b971800f4bdb85e1bf8f7c.exe 9fbb8a90e9b971800f4bdb85e1bf8f7c.exe PID 2632 wrote to memory of 2796 2632 9fbb8a90e9b971800f4bdb85e1bf8f7c.exe 9fbb8a90e9b971800f4bdb85e1bf8f7c.exe PID 2632 wrote to memory of 2796 2632 9fbb8a90e9b971800f4bdb85e1bf8f7c.exe 9fbb8a90e9b971800f4bdb85e1bf8f7c.exe PID 2632 wrote to memory of 2796 2632 9fbb8a90e9b971800f4bdb85e1bf8f7c.exe 9fbb8a90e9b971800f4bdb85e1bf8f7c.exe PID 2632 wrote to memory of 2796 2632 9fbb8a90e9b971800f4bdb85e1bf8f7c.exe 9fbb8a90e9b971800f4bdb85e1bf8f7c.exe PID 2160 wrote to memory of 2832 2160 ssme.exe ssme.exe PID 2160 wrote to memory of 2832 2160 ssme.exe ssme.exe PID 2160 wrote to memory of 2832 2160 ssme.exe ssme.exe PID 2160 wrote to memory of 2832 2160 ssme.exe ssme.exe PID 2160 wrote to memory of 2832 2160 ssme.exe ssme.exe PID 2644 wrote to memory of 2696 2644 faame.exe faame.exe PID 2644 wrote to memory of 2696 2644 faame.exe faame.exe PID 2644 wrote to memory of 2696 2644 faame.exe faame.exe PID 2644 wrote to memory of 2696 2644 faame.exe faame.exe PID 2644 wrote to memory of 2696 2644 faame.exe faame.exe PID 2696 wrote to memory of 2952 2696 faame.exe WerFault.exe PID 2696 wrote to memory of 2952 2696 faame.exe WerFault.exe PID 2696 wrote to memory of 2952 2696 faame.exe WerFault.exe PID 2696 wrote to memory of 2952 2696 faame.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fbb8a90e9b971800f4bdb85e1bf8f7c.exe"C:\Users\Admin\AppData\Local\Temp\9fbb8a90e9b971800f4bdb85e1bf8f7c.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ssme.exe"C:\Users\Admin\AppData\Local\Temp\ssme.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ssme.exe"C:\Users\Admin\AppData\Local\Temp\ssme.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\faame.exe"C:\Users\Admin\AppData\Local\Temp\faame.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\faame.exe"C:\Users\Admin\AppData\Local\Temp\faame.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 7884⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\9fbb8a90e9b971800f4bdb85e1bf8f7c.exe"C:\Users\Admin\AppData\Local\Temp\9fbb8a90e9b971800f4bdb85e1bf8f7c.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\faame.exeFilesize
276KB
MD52618de7ce265814bb7c9db2d040a648c
SHA18124cdb548ade9b39c84cc3d87de270e46bd0496
SHA2560ee0befc1f8446bc1a86d0c18ad5674520c779434eb3a78ea0d64be1ef5d7622
SHA512925e1a29e20bd343132b465504245643f6fc345bd42cc75944278a6559e919dabf606e8b56a36ca3aec2780c12981065ffa08f273adfe828084758af3702e253
-
\Users\Admin\AppData\Local\Temp\ssme.exeFilesize
228KB
MD559337e167d10c145b4907027b618ae62
SHA18a7b0f563297f060a8f2cbcc32b8bac7028bbd6b
SHA256b22e796ca4e1031b444aafbcd498fefe0cbc1f6fd37334090529be8c9bc14cf4
SHA51240ceae1055f7cf9bb9068c84bb7b29a37eb4720fa30de709e82a96335a2c71b8a58a51b2543b277b4d2b6362339280f6dc5dd7000247589b2d75692cad7c6e52
-
memory/2160-26-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/2632-2-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2632-24-0x00000000005A0000-0x00000000005A7000-memory.dmpFilesize
28KB
-
memory/2644-30-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2696-45-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2696-61-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2696-60-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2696-37-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2696-51-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2796-29-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/2796-43-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/2796-50-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/2796-46-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/2796-58-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/2832-42-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2832-49-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2832-48-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2832-38-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2832-31-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB