Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19-03-2024 17:25
Static task
static1
Behavioral task
behavioral1
Sample
d6b2e107ac7ba9cb55fceb901651519b.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
d6b2e107ac7ba9cb55fceb901651519b.exe
Resource
win10v2004-20240226-en
General
-
Target
d6b2e107ac7ba9cb55fceb901651519b.exe
-
Size
518KB
-
MD5
d6b2e107ac7ba9cb55fceb901651519b
-
SHA1
a225e6ebcdc0a7b69e9fb588d1e88b3d576d8392
-
SHA256
91eb4aa588c6607ad27fb9b43d61166230a225d8a4aa517d685af28ab4382a26
-
SHA512
d417d7a8e0ee1565f5a70503e7fde1279da3bf4df7bc3dcb1c7d51b0790216a9e18e58b061fdae652f04feccfa57e5b8433b82a5c2fb34c7022394a0055feb3b
-
SSDEEP
12288:+xNExf+83gnVZd3OOm9Fd/rL2qsdGG58D:ce28QnVZNOT9F5mGG58D
Malware Config
Extracted
raccoon
1.7.3
92be0387873e54dd629b9bfa972c3a9a88e6726c
-
url4cnc
https://t.me/gishsunsetman
Signatures
-
Raccoon Stealer V1 payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2540-5-0x0000000000400000-0x0000000000495000-memory.dmp family_raccoon_v1 behavioral1/memory/2540-8-0x0000000000400000-0x0000000000495000-memory.dmp family_raccoon_v1 behavioral1/memory/2540-9-0x0000000000400000-0x0000000000495000-memory.dmp family_raccoon_v1 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
d6b2e107ac7ba9cb55fceb901651519b.exedescription pid process target process PID 2356 set thread context of 2540 2356 d6b2e107ac7ba9cb55fceb901651519b.exe d6b2e107ac7ba9cb55fceb901651519b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
d6b2e107ac7ba9cb55fceb901651519b.exedescription pid process Token: SeDebugPrivilege 2356 d6b2e107ac7ba9cb55fceb901651519b.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
d6b2e107ac7ba9cb55fceb901651519b.exedescription pid process target process PID 2356 wrote to memory of 2540 2356 d6b2e107ac7ba9cb55fceb901651519b.exe d6b2e107ac7ba9cb55fceb901651519b.exe PID 2356 wrote to memory of 2540 2356 d6b2e107ac7ba9cb55fceb901651519b.exe d6b2e107ac7ba9cb55fceb901651519b.exe PID 2356 wrote to memory of 2540 2356 d6b2e107ac7ba9cb55fceb901651519b.exe d6b2e107ac7ba9cb55fceb901651519b.exe PID 2356 wrote to memory of 2540 2356 d6b2e107ac7ba9cb55fceb901651519b.exe d6b2e107ac7ba9cb55fceb901651519b.exe PID 2356 wrote to memory of 2540 2356 d6b2e107ac7ba9cb55fceb901651519b.exe d6b2e107ac7ba9cb55fceb901651519b.exe PID 2356 wrote to memory of 2540 2356 d6b2e107ac7ba9cb55fceb901651519b.exe d6b2e107ac7ba9cb55fceb901651519b.exe PID 2356 wrote to memory of 2540 2356 d6b2e107ac7ba9cb55fceb901651519b.exe d6b2e107ac7ba9cb55fceb901651519b.exe PID 2356 wrote to memory of 2540 2356 d6b2e107ac7ba9cb55fceb901651519b.exe d6b2e107ac7ba9cb55fceb901651519b.exe PID 2356 wrote to memory of 2540 2356 d6b2e107ac7ba9cb55fceb901651519b.exe d6b2e107ac7ba9cb55fceb901651519b.exe PID 2356 wrote to memory of 2540 2356 d6b2e107ac7ba9cb55fceb901651519b.exe d6b2e107ac7ba9cb55fceb901651519b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6b2e107ac7ba9cb55fceb901651519b.exe"C:\Users\Admin\AppData\Local\Temp\d6b2e107ac7ba9cb55fceb901651519b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d6b2e107ac7ba9cb55fceb901651519b.exeC:\Users\Admin\AppData\Local\Temp\d6b2e107ac7ba9cb55fceb901651519b.exe2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2356-0-0x0000000000D10000-0x0000000000D94000-memory.dmpFilesize
528KB
-
memory/2356-1-0x0000000074AA0000-0x000000007518E000-memory.dmpFilesize
6.9MB
-
memory/2356-2-0x0000000000330000-0x0000000000370000-memory.dmpFilesize
256KB
-
memory/2356-3-0x0000000074AA0000-0x000000007518E000-memory.dmpFilesize
6.9MB
-
memory/2356-4-0x0000000000370000-0x0000000000390000-memory.dmpFilesize
128KB
-
memory/2356-7-0x0000000074AA0000-0x000000007518E000-memory.dmpFilesize
6.9MB
-
memory/2540-5-0x0000000000400000-0x0000000000495000-memory.dmpFilesize
596KB
-
memory/2540-8-0x0000000000400000-0x0000000000495000-memory.dmpFilesize
596KB
-
memory/2540-9-0x0000000000400000-0x0000000000495000-memory.dmpFilesize
596KB