Malware Analysis Report

2025-01-18 12:05

Sample ID 240303-g5e8caeh27
Target Wondershare Filmora 13 (UPDATED).exe
SHA256 bd60fb33b1bd8fcebb8cf0d0e64fbceaa7b7c609330d7f790200fcf706e86152
Tags
raccoon 6c425a69112fca2eaf443947597c0b13 stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bd60fb33b1bd8fcebb8cf0d0e64fbceaa7b7c609330d7f790200fcf706e86152

Threat Level: Known bad

The file Wondershare Filmora 13 (UPDATED).exe was found to be: Known bad.

Malicious Activity Summary

raccoon 6c425a69112fca2eaf443947597c0b13 stealer

Suspicious use of NtCreateUserProcessOtherParentProcess

Raccoon

Raccoon Stealer V2 payload

Loads dropped DLL

Executes dropped EXE

Suspicious use of SetThreadContext

Unsigned PE

Program crash

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Checks SCSI registry key(s)

Runs ping.exe

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates processes with tasklist

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-03 06:23

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-03-03 06:23

Reported

2024-03-03 06:25

Platform

win10v2004-20240226-en

Max time kernel

145s

Max time network

156s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4940 wrote to memory of 4928 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4940 wrote to memory of 4928 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4940 wrote to memory of 4928 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4928 -ip 4928

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 138.201.86.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 152.141.79.40.in-addr.arpa udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-03-03 06:23

Reported

2024-03-03 06:23

Platform

win10v2004-20240226-en

Max time kernel

0s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 udp
N/A 40.126.31.71:443 tcp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-03-03 06:23

Reported

2024-03-03 06:25

Platform

win7-20240221-en

Max time kernel

122s

Max time network

125s

Command Line

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\$TEMP\Stood.ps1

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\$TEMP\Stood.ps1

Network

N/A

Files

memory/2936-5-0x000007FEF5F40000-0x000007FEF68DD000-memory.dmp

memory/2936-4-0x000000001B120000-0x000000001B402000-memory.dmp

memory/2936-7-0x0000000002490000-0x0000000002498000-memory.dmp

memory/2936-8-0x00000000027C0000-0x0000000002840000-memory.dmp

memory/2936-9-0x00000000027C0000-0x0000000002840000-memory.dmp

memory/2936-6-0x00000000027C0000-0x0000000002840000-memory.dmp

memory/2936-10-0x000007FEF5F40000-0x000007FEF68DD000-memory.dmp

memory/2936-11-0x00000000027C0000-0x0000000002840000-memory.dmp

memory/2936-12-0x000007FEF5F40000-0x000007FEF68DD000-memory.dmp

memory/2936-13-0x00000000027C0000-0x0000000002840000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-03-03 06:23

Reported

2024-03-03 06:26

Platform

win10v2004-20240226-en

Max time kernel

110s

Max time network

165s

Command Line

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\$TEMP\Stood.ps1

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\$TEMP\Stood.ps1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=2240,i,16875000905773190493,11379096115878622792,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
GB 216.58.212.202:443 tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 80.192.122.92.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t1dtbhtw.2xt.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3736-5-0x000001BE86930000-0x000001BE86952000-memory.dmp

memory/3736-10-0x00007FFBC60A0000-0x00007FFBC6B61000-memory.dmp

memory/3736-11-0x000001BE86980000-0x000001BE86990000-memory.dmp

memory/3736-12-0x000001BE86980000-0x000001BE86990000-memory.dmp

memory/3736-13-0x000001BE86980000-0x000001BE86990000-memory.dmp

memory/3736-16-0x00007FFBC60A0000-0x00007FFBC6B61000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-03 06:23

Reported

2024-03-03 06:25

Platform

win7-20240221-en

Max time kernel

120s

Max time network

124s

Command Line

C:\Windows\Explorer.EXE

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 1116 created 1400 N/A C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif C:\Windows\Explorer.EXE

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1116 set thread context of 3000 N/A C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif

Enumerates physical storage devices

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2224 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\Wondershare Filmora 13 (UPDATED).exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\Wondershare Filmora 13 (UPDATED).exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\Wondershare Filmora 13 (UPDATED).exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\Wondershare Filmora 13 (UPDATED).exe C:\Windows\SysWOW64\cmd.exe
PID 2516 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2516 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2516 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2516 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2516 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2516 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2516 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2516 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2516 wrote to memory of 2904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2516 wrote to memory of 2904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2516 wrote to memory of 2904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2516 wrote to memory of 2904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2516 wrote to memory of 2444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2516 wrote to memory of 2444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2516 wrote to memory of 2444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2516 wrote to memory of 2444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2516 wrote to memory of 3028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2516 wrote to memory of 3028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2516 wrote to memory of 3028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2516 wrote to memory of 3028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2516 wrote to memory of 2572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2516 wrote to memory of 2572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2516 wrote to memory of 2572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2516 wrote to memory of 2572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2516 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2516 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2516 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2516 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2516 wrote to memory of 1116 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif
PID 2516 wrote to memory of 1116 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif
PID 2516 wrote to memory of 1116 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif
PID 2516 wrote to memory of 1116 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif
PID 2516 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2516 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2516 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2516 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1116 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif
PID 1116 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif
PID 1116 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif
PID 1116 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif
PID 1116 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif
PID 1116 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\Wondershare Filmora 13 (UPDATED).exe

"C:\Users\Admin\AppData\Local\Temp\Wondershare Filmora 13 (UPDATED).exe"

C:\Windows\SysWOW64\cmd.exe

"cmd" /k move Sexually Sexually.bat & Sexually.bat & exit

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 10910

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Shoe + Called + Ap + Extend + Characteristic + Anybody 10910\Bros.pif

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Va + Modem + Stood 10910\o

C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif

10910\Bros.pif 10910\o

C:\Windows\SysWOW64\PING.EXE

ping -n 5 127.0.0.1

C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif

C:\Users\Admin\AppData\Local\Temp\10910\Bros.pif

Network

Country Destination Domain Proto
US 8.8.8.8:53 OLdKdTWWIg.OLdKdTWWIg udp
RU 82.146.45.177:80 tcp
RU 82.146.45.177:80 tcp

Files

\Users\Admin\AppData\Local\Temp\nst479C.tmp\nsExec.dll

MD5 675c4948e1efc929edcabfe67148eddd
SHA1 f5bdd2c4329ed2732ecfe3423c3cc482606eb28e
SHA256 1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906
SHA512 61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

C:\Users\Admin\AppData\Local\Temp\Sexually

MD5 8c94c45366d520581deae7733e55d53d
SHA1 5d4081b31f366f941d44d073f96bdc9c302b81f2
SHA256 cb6e00d2d385dd6988245438534de2be67cd9ea3ce9a3efef93fa2778787c0b2
SHA512 5c8053f61610495b6b91b9e5808de7c2804959210b8d65cb918c9731b4d1b8e7b2824927da2ae102c373450c77bedb1100c176f9a410dae55fb82d2a8c053a22

C:\Users\Admin\AppData\Local\Temp\Shoe

MD5 68c0513a3c2315614b461cc10a66c438
SHA1 c9eeb00f03dcf790abef25e09e0b59ab1225748d
SHA256 fde0ef0e07eff281420a21edf4a8a83b2b1047ea567d1819161a70cf2a32fd69
SHA512 1af68a061f502623cc4ce6b505d56938862208736d09470f46b963741ce9d74c64771107c8f02ce2347010c59f4c06cb4e7802e6243387d3f4e07000d496537f

C:\Users\Admin\AppData\Local\Temp\Anybody

MD5 7937be6856fbfc313a4d6dfdef3e716d
SHA1 935e1c279ae63e009216cd4810c60b0ad2b4f64d
SHA256 d912920ebda9945eb75f25f572ca83e5edf847cb6a33c49fef4e8a2b0f155a4f
SHA512 c5e8d6262d0f65e3f65e905b1973fa8e862854423666ff1759745c70db70de2fe19801f43cdd37b65c7effc0afcd1478b126d14ae4d73145572bfcf08bdd1797

C:\Users\Admin\AppData\Local\Temp\Characteristic

MD5 cbef2199e1f6ff01e45db56b3a944007
SHA1 d55d82f4244fe0b4b13e92ff22db6163376c6e09
SHA256 ef555412266493269fbc15e702ef1f8a30e2bb31f8b6272bcb38fa49edc112c1
SHA512 0d54f7213a7400019ccf028b2889aab0f4130cf4b4c6cf194cb74d265bfbcda38641af7481ef4a9ac1adee3b472b15b034ad4c709ba3bfd2153c70c45fa75f8d

C:\Users\Admin\AppData\Local\Temp\Extend

MD5 df57f97e6eae1022797fb643cb684762
SHA1 e4c61f84ba1cc58bde57693f81b334a248c3657d
SHA256 726cc11273fb2bebdd881eaf1c3851ee43c35c7904119f0a93246b5c0846f421
SHA512 2ecdd54334105e68992e1a1ee125790c9a20181a1f7ed816bc17557d85abf42fe8b1b28c4dd8630d5b8785fab9a21634202f822c33c411830104d292e05a3f30

C:\Users\Admin\AppData\Local\Temp\Ap

MD5 5c4115ade8e3ca9fbf0d5feee5bdd9d3
SHA1 1ea59c742297ebd520a97a460df9bd6ba456edc3
SHA256 43f962374be47a19e91dbb9c9e5cac76c9406c0718533c7e232a78d04d43c178
SHA512 2b23ee48b4cefe12a44643e96a68a11ed8721bb0a87b3ddffe0a7e401ef2418e40379a9cbadaac62a97d9f3c95b0b8b862be775016bb97c526cfc10cb1c124ed

C:\Users\Admin\AppData\Local\Temp\Called

MD5 d5008d637b577128400ea5c30b3ad1e8
SHA1 617ecf0776f1d2f4638043e5ace1d904dd46612d
SHA256 357d06fd988cff87f16f12c79d7f8d084502bf0622a3accf278988c718d8f809
SHA512 ead5105ae8265cf680723c7cac19ebeb698a0a2327ef244747070b971d29abe0f1424d729e7ee09006725e53e64dd81ec4e89086266b82eeaf7bd273cb4eef1f

C:\Users\Admin\AppData\Local\Temp\Va

MD5 656a795f7ece4b52fd4a365de3e55f1b
SHA1 3f5c6d331266b8e775ea457ad9e2a8331db37967
SHA256 2c72540237b39807c9fac12d7137e4107f57c6e1f4541e01d89ef86a6ad1e8ea
SHA512 2851d3937272c661dc26ecede08cc1ae33e3df23128a81d13958427a3110081e636daab8c1a1a696b3aba1d70d7483183c4556810276046b5b130215f9b902c0

C:\Users\Admin\AppData\Local\Temp\Modem

MD5 2598f9c23fea20eebbab1ee31483525e
SHA1 45d400e96c576092b3c2bff47732ffa0784569b6
SHA256 525f662ff407f2fb42628bc5a838865b6abcbe1487a625587fd0495bb90a62c6
SHA512 9badc58ca1b09b7941b2ed031f025b26169cbea66d04392ea92b33ad6004268629512a29ba5ef1c3f0392e9cb053166d735ec0b476121dae2d8c4953cdf05c04

C:\Users\Admin\AppData\Local\Temp\Stood

MD5 23887b360a8d24e7670ffe58729297a5
SHA1 c2488c86d46f62cde0a525a55f7411d1a51930ce
SHA256 d93784bef64a291bcd941c0f9631aa50fc1deaede80fab5ba0be668f985e1ff6
SHA512 ab96022a4508a3be1ae9b4e98defd7be11077d60de2e857b3c5ab3936bc513ea47d91d0a0a9543aa5d948db46eed57e669281c1e69df0ef3c88e19154b156c22

\Users\Admin\AppData\Local\Temp\10910\Bros.pif

MD5 848164d084384c49937f99d5b894253e
SHA1 3055ef803eeec4f175ebf120f94125717ee12444
SHA256 f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
SHA512 aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a

C:\Users\Admin\AppData\Local\Temp\10910\o

MD5 c89326d2551a0973a051d5dd01966446
SHA1 b654271a170d90a210d56a5f90401e316f19d289
SHA256 a8fad4f4b3cc432bafd32c0e4565519dba94fe73682c4528161f5ac8931f685d
SHA512 2830a484cafba746e04b9ee292e6f2ef21528ca86029365f7e2d9628d08ba8cf0704ce64ed29f8d25cc4e5d7ec5a200917d319df4040b28b233372de1c9d9c9a

memory/1116-31-0x00000000776D0000-0x00000000777A6000-memory.dmp

memory/1116-35-0x0000000000140000-0x0000000000141000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-03 06:23

Reported

2024-03-03 06:25

Platform

win10v2004-20240226-en

Max time kernel

147s

Max time network

155s

Command Line

C:\Windows\Explorer.EXE

Signatures

Raccoon

stealer raccoon

Raccoon Stealer V2 payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 4668 created 3536 N/A C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif C:\Windows\Explorer.EXE

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Wondershare Filmora 13 (UPDATED).exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4668 set thread context of 1056 N/A C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: 33 N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4300 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\Wondershare Filmora 13 (UPDATED).exe C:\Windows\SysWOW64\cmd.exe
PID 4300 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\Wondershare Filmora 13 (UPDATED).exe C:\Windows\SysWOW64\cmd.exe
PID 4300 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\Wondershare Filmora 13 (UPDATED).exe C:\Windows\SysWOW64\cmd.exe
PID 4948 wrote to memory of 4712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4948 wrote to memory of 4712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4948 wrote to memory of 4712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4948 wrote to memory of 4900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4948 wrote to memory of 4900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4948 wrote to memory of 4900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4948 wrote to memory of 632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4948 wrote to memory of 632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4948 wrote to memory of 632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4948 wrote to memory of 2324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4948 wrote to memory of 2324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4948 wrote to memory of 2324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4948 wrote to memory of 4052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4948 wrote to memory of 4052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4948 wrote to memory of 4052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4948 wrote to memory of 4560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4948 wrote to memory of 4560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4948 wrote to memory of 4560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4948 wrote to memory of 1924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4948 wrote to memory of 1924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4948 wrote to memory of 1924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4948 wrote to memory of 4668 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif
PID 4948 wrote to memory of 4668 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif
PID 4948 wrote to memory of 4668 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif
PID 4948 wrote to memory of 3100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4948 wrote to memory of 3100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4948 wrote to memory of 3100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4668 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif
PID 4668 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif
PID 4668 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif
PID 4668 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif
PID 4668 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\Wondershare Filmora 13 (UPDATED).exe

"C:\Users\Admin\AppData\Local\Temp\Wondershare Filmora 13 (UPDATED).exe"

C:\Windows\SysWOW64\cmd.exe

"cmd" /k move Sexually Sexually.bat & Sexually.bat & exit

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 10917

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Shoe + Called + Ap + Extend + Characteristic + Anybody 10917\Bros.pif

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Va + Modem + Stood 10917\o

C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif

10917\Bros.pif 10917\o

C:\Windows\SysWOW64\PING.EXE

ping -n 5 127.0.0.1

C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif

C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

Network

Country Destination Domain Proto
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 OLdKdTWWIg.OLdKdTWWIg udp
RU 82.146.45.177:80 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 152.141.79.40.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nsb6FD2.tmp\nsExec.dll

MD5 675c4948e1efc929edcabfe67148eddd
SHA1 f5bdd2c4329ed2732ecfe3423c3cc482606eb28e
SHA256 1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906
SHA512 61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

C:\Users\Admin\AppData\Local\Temp\Sexually

MD5 8c94c45366d520581deae7733e55d53d
SHA1 5d4081b31f366f941d44d073f96bdc9c302b81f2
SHA256 cb6e00d2d385dd6988245438534de2be67cd9ea3ce9a3efef93fa2778787c0b2
SHA512 5c8053f61610495b6b91b9e5808de7c2804959210b8d65cb918c9731b4d1b8e7b2824927da2ae102c373450c77bedb1100c176f9a410dae55fb82d2a8c053a22

C:\Users\Admin\AppData\Local\Temp\Shoe

MD5 68c0513a3c2315614b461cc10a66c438
SHA1 c9eeb00f03dcf790abef25e09e0b59ab1225748d
SHA256 fde0ef0e07eff281420a21edf4a8a83b2b1047ea567d1819161a70cf2a32fd69
SHA512 1af68a061f502623cc4ce6b505d56938862208736d09470f46b963741ce9d74c64771107c8f02ce2347010c59f4c06cb4e7802e6243387d3f4e07000d496537f

C:\Users\Admin\AppData\Local\Temp\Extend

MD5 df57f97e6eae1022797fb643cb684762
SHA1 e4c61f84ba1cc58bde57693f81b334a248c3657d
SHA256 726cc11273fb2bebdd881eaf1c3851ee43c35c7904119f0a93246b5c0846f421
SHA512 2ecdd54334105e68992e1a1ee125790c9a20181a1f7ed816bc17557d85abf42fe8b1b28c4dd8630d5b8785fab9a21634202f822c33c411830104d292e05a3f30

C:\Users\Admin\AppData\Local\Temp\Anybody

MD5 7937be6856fbfc313a4d6dfdef3e716d
SHA1 935e1c279ae63e009216cd4810c60b0ad2b4f64d
SHA256 d912920ebda9945eb75f25f572ca83e5edf847cb6a33c49fef4e8a2b0f155a4f
SHA512 c5e8d6262d0f65e3f65e905b1973fa8e862854423666ff1759745c70db70de2fe19801f43cdd37b65c7effc0afcd1478b126d14ae4d73145572bfcf08bdd1797

C:\Users\Admin\AppData\Local\Temp\Characteristic

MD5 cbef2199e1f6ff01e45db56b3a944007
SHA1 d55d82f4244fe0b4b13e92ff22db6163376c6e09
SHA256 ef555412266493269fbc15e702ef1f8a30e2bb31f8b6272bcb38fa49edc112c1
SHA512 0d54f7213a7400019ccf028b2889aab0f4130cf4b4c6cf194cb74d265bfbcda38641af7481ef4a9ac1adee3b472b15b034ad4c709ba3bfd2153c70c45fa75f8d

C:\Users\Admin\AppData\Local\Temp\Called

MD5 d5008d637b577128400ea5c30b3ad1e8
SHA1 617ecf0776f1d2f4638043e5ace1d904dd46612d
SHA256 357d06fd988cff87f16f12c79d7f8d084502bf0622a3accf278988c718d8f809
SHA512 ead5105ae8265cf680723c7cac19ebeb698a0a2327ef244747070b971d29abe0f1424d729e7ee09006725e53e64dd81ec4e89086266b82eeaf7bd273cb4eef1f

C:\Users\Admin\AppData\Local\Temp\Stood

MD5 23887b360a8d24e7670ffe58729297a5
SHA1 c2488c86d46f62cde0a525a55f7411d1a51930ce
SHA256 d93784bef64a291bcd941c0f9631aa50fc1deaede80fab5ba0be668f985e1ff6
SHA512 ab96022a4508a3be1ae9b4e98defd7be11077d60de2e857b3c5ab3936bc513ea47d91d0a0a9543aa5d948db46eed57e669281c1e69df0ef3c88e19154b156c22

C:\Users\Admin\AppData\Local\Temp\Modem

MD5 2598f9c23fea20eebbab1ee31483525e
SHA1 45d400e96c576092b3c2bff47732ffa0784569b6
SHA256 525f662ff407f2fb42628bc5a838865b6abcbe1487a625587fd0495bb90a62c6
SHA512 9badc58ca1b09b7941b2ed031f025b26169cbea66d04392ea92b33ad6004268629512a29ba5ef1c3f0392e9cb053166d735ec0b476121dae2d8c4953cdf05c04

C:\Users\Admin\AppData\Local\Temp\Va

MD5 656a795f7ece4b52fd4a365de3e55f1b
SHA1 3f5c6d331266b8e775ea457ad9e2a8331db37967
SHA256 2c72540237b39807c9fac12d7137e4107f57c6e1f4541e01d89ef86a6ad1e8ea
SHA512 2851d3937272c661dc26ecede08cc1ae33e3df23128a81d13958427a3110081e636daab8c1a1a696b3aba1d70d7483183c4556810276046b5b130215f9b902c0

C:\Users\Admin\AppData\Local\Temp\Ap

MD5 5c4115ade8e3ca9fbf0d5feee5bdd9d3
SHA1 1ea59c742297ebd520a97a460df9bd6ba456edc3
SHA256 43f962374be47a19e91dbb9c9e5cac76c9406c0718533c7e232a78d04d43c178
SHA512 2b23ee48b4cefe12a44643e96a68a11ed8721bb0a87b3ddffe0a7e401ef2418e40379a9cbadaac62a97d9f3c95b0b8b862be775016bb97c526cfc10cb1c124ed

C:\Users\Admin\AppData\Local\Temp\10917\Bros.pif

MD5 848164d084384c49937f99d5b894253e
SHA1 3055ef803eeec4f175ebf120f94125717ee12444
SHA256 f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
SHA512 aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a

C:\Users\Admin\AppData\Local\Temp\10917\o

MD5 c89326d2551a0973a051d5dd01966446
SHA1 b654271a170d90a210d56a5f90401e316f19d289
SHA256 a8fad4f4b3cc432bafd32c0e4565519dba94fe73682c4528161f5ac8931f685d
SHA512 2830a484cafba746e04b9ee292e6f2ef21528ca86029365f7e2d9628d08ba8cf0704ce64ed29f8d25cc4e5d7ec5a200917d319df4040b28b233372de1c9d9c9a

memory/4668-29-0x0000000076EF1000-0x0000000077011000-memory.dmp

memory/4668-32-0x00000000010F0000-0x00000000010F1000-memory.dmp

memory/1056-34-0x0000000000400000-0x0000000000416000-memory.dmp

memory/1056-35-0x0000000000400000-0x0000000000416000-memory.dmp

memory/1056-37-0x0000000000400000-0x0000000000416000-memory.dmp

memory/3588-39-0x00000207C2900000-0x00000207C2901000-memory.dmp

memory/3588-38-0x00000207C2900000-0x00000207C2901000-memory.dmp

memory/3588-40-0x00000207C2900000-0x00000207C2901000-memory.dmp

memory/3588-44-0x00000207C2900000-0x00000207C2901000-memory.dmp

memory/3588-45-0x00000207C2900000-0x00000207C2901000-memory.dmp

memory/3588-46-0x00000207C2900000-0x00000207C2901000-memory.dmp

memory/3588-47-0x00000207C2900000-0x00000207C2901000-memory.dmp

memory/3588-48-0x00000207C2900000-0x00000207C2901000-memory.dmp

memory/3588-49-0x00000207C2900000-0x00000207C2901000-memory.dmp

memory/3588-50-0x00000207C2900000-0x00000207C2901000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-03-03 06:23

Reported

2024-03-03 06:25

Platform

win7-20240220-en

Max time kernel

122s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 220

Network

N/A

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-03-03 06:23

Reported

2024-03-03 06:23

Platform

win7-20240221-en

Max time kernel

0s

Max time network

4s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A