Analysis
- max time kernel
148s - max time network
150s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
29/02/2024, 17:44
General
- Target af175128a823db1274fc244d8f5a46bd.exe
- Size 16.6MB
- Sample240229-wa7fnsga3s
- SHA256 fc10619c7cb6b5de6ba8f58fd3ff889045ef77ea4cde4de7c5f313dbef1a7bc3
Malware Config
Extracted
-
raccoon
-
1.7.3
-
6f477b98912ea3958a37585999397f4fbda5dc46
-
url4cnc
https://telete.in/chelmedvedosvin1
Signatures
- BLISTER
BLISTER is a downloader used to deliver other malware families.
- Detect Blister loader x32 5 IoCs
- Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
- Raccoon Stealer V1 payload 2 IoCs
- Loads dropped DLL 1 IoCs
- VMProtect packed file 5 IoCs
Detects executables packed with VMProtect commercial packer.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 2 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\af175128a823db1274fc244d8f5a46bd.exe"C:\Users\Admin\AppData\Local\Temp\af175128a823db1274fc244d8f5a46bd.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\af175128a823db1274fc244d8f5a46bd.exe"C:\Users\Admin\AppData\Local\Temp\af175128a823db1274fc244d8f5a46bd.exe"2⤵
- Modifies system certificate store
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Diagnostic asda.exe
libcef.dll
memory/1948-30-0x00000000028A0000-0x00000000028A1000-memory.dmp
memory/1948-20-0x0000000002870000-0x0000000002871000-memory.dmp
memory/1948-4-0x0000000001C10000-0x0000000001C11000-memory.dmp
memory/1948-10-0x0000000001C10000-0x0000000001C11000-memory.dmp
memory/1948-11-0x0000000002860000-0x0000000002861000-memory.dmp
memory/1948-13-0x0000000002860000-0x0000000002861000-memory.dmp
memory/1948-15-0x0000000002860000-0x0000000002861000-memory.dmp
memory/1948-23-0x0000000002890000-0x0000000002891000-memory.dmp
memory/1948-28-0x00000000028A0000-0x00000000028A1000-memory.dmp
memory/1948-25-0x0000000002890000-0x0000000002891000-memory.dmp
memory/1948-8-0x0000000001C10000-0x0000000001C11000-memory.dmp
memory/1948-7-0x0000000072360000-0x000000007416F000-memory.dmp
memory/1948-18-0x0000000002870000-0x0000000002871000-memory.dmp
memory/1948-33-0x00000000028B0000-0x00000000028B1000-memory.dmp
memory/1948-35-0x00000000028B0000-0x00000000028B1000-memory.dmp
memory/1948-36-0x00000000028C0000-0x00000000028C1000-memory.dmp
memory/1948-38-0x00000000028C0000-0x00000000028C1000-memory.dmp
memory/1948-40-0x00000000028C0000-0x00000000028C1000-memory.dmp
memory/1948-47-0x0000000072360000-0x000000007416F000-memory.dmp
memory/1948-5-0x0000000072360000-0x000000007416F000-memory.dmp
memory/1948-59-0x0000000072360000-0x000000007416F000-memory.dmp
memory/2380-52-0x00000000001C0000-0x0000000000255000-memory.dmp
memory/2380-58-0x00000000001C0000-0x0000000000255000-memory.dmp