Analysis
- max time kernel
149s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
29/02/2024, 17:44
General
- Target af175128a823db1274fc244d8f5a46bd.exe
- Size 16.6MB
- Sample240229-wa7fnsga3s
- SHA256 fc10619c7cb6b5de6ba8f58fd3ff889045ef77ea4cde4de7c5f313dbef1a7bc3
Malware Config
Extracted
-
raccoon
-
1.7.3
-
6f477b98912ea3958a37585999397f4fbda5dc46
-
url4cnc
https://telete.in/chelmedvedosvin1
Signatures
- BLISTER
BLISTER is a downloader used to deliver other malware families.
- Detect Blister loader x32 4 IoCs
- Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
- Raccoon Stealer V1 payload 2 IoCs
- Loads dropped DLL 1 IoCs
- VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 2 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\af175128a823db1274fc244d8f5a46bd.exe"C:\Users\Admin\AppData\Local\Temp\af175128a823db1274fc244d8f5a46bd.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\af175128a823db1274fc244d8f5a46bd.exe"C:\Users\Admin\AppData\Local\Temp\af175128a823db1274fc244d8f5a46bd.exe"2⤵
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Diagnostic asda.exe
libcef.dll
memory/1584-6-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/1584-7-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/1584-9-0x0000000002AF0000-0x0000000002AF1000-memory.dmp
memory/1584-8-0x0000000002AE0000-0x0000000002AE1000-memory.dmp
memory/1584-5-0x0000000002A90000-0x0000000002A91000-memory.dmp
memory/1584-11-0x00000000727A0000-0x00000000745AF000-memory.dmp
memory/1584-10-0x0000000002B00000-0x0000000002B01000-memory.dmp
memory/1584-18-0x00000000727A0000-0x00000000745AF000-memory.dmp
memory/1584-4-0x0000000002A80000-0x0000000002A81000-memory.dmp
memory/1584-30-0x00000000727A0000-0x00000000745AF000-memory.dmp
memory/4308-23-0x0000000000440000-0x00000000004D5000-memory.dmp
memory/4308-29-0x0000000000440000-0x00000000004D5000-memory.dmp