Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2024, 00:41
Static task
static1
Behavioral task
behavioral1
Sample
2AB36B7875F2B5A876377164B3B609F2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2AB36B7875F2B5A876377164B3B609F2.exe
Resource
win10v2004-20240226-en
General
-
Target
2AB36B7875F2B5A876377164B3B609F2.exe
-
Size
2.9MB
-
MD5
2ab36b7875f2b5a876377164b3b609f2
-
SHA1
0d022cf7d49015fc97c576d89a710e5aeabaeaff
-
SHA256
0f8e95a2c0575292fe6b8151428013f85b645f315e2d67a927a4b0c6d26af3c9
-
SHA512
e62f221b3e3a7d2d14e56519ca46e69af3c2570d8d2d9cc382c9778fe37a75567b3af311074ed1709a0385d9bd38e11dd2ed8dbd1b30427b53d56266fe486238
-
SSDEEP
49152:ueG4DbBlHFAYl0R2fvjnZ1tmr5BOFGdoYNStv4Qr/0O0NAfT6ZI5I7+SPqKSM1x4:ueGUGAfT1e+hKhDPa
Malware Config
Extracted
raccoon
4a9f651f0c883b5f75c545d430f6c021
http://192.227.94.170:80
-
user_agent
MrBidenNeverKnow
Signatures
-
Raccoon Stealer V2 payload 7 IoCs
resource yara_rule behavioral2/memory/3620-7-0x0000000000400000-0x00000000006EE000-memory.dmp family_raccoon_v2 behavioral2/memory/4972-8-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon_v2 behavioral2/memory/4972-9-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon_v2 behavioral2/memory/4972-10-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon_v2 behavioral2/memory/4972-14-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon_v2 behavioral2/memory/4972-59-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon_v2 behavioral2/memory/4972-75-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon_v2 -
Downloads MZ/PE file
-
Loads dropped DLL 3 IoCs
pid Process 4972 2AB36B7875F2B5A876377164B3B609F2.exe 4972 2AB36B7875F2B5A876377164B3B609F2.exe 4972 2AB36B7875F2B5A876377164B3B609F2.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 3620 2AB36B7875F2B5A876377164B3B609F2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4972 2AB36B7875F2B5A876377164B3B609F2.exe 4972 2AB36B7875F2B5A876377164B3B609F2.exe 4972 2AB36B7875F2B5A876377164B3B609F2.exe 4972 2AB36B7875F2B5A876377164B3B609F2.exe 4972 2AB36B7875F2B5A876377164B3B609F2.exe 4972 2AB36B7875F2B5A876377164B3B609F2.exe 4972 2AB36B7875F2B5A876377164B3B609F2.exe 4972 2AB36B7875F2B5A876377164B3B609F2.exe 4972 2AB36B7875F2B5A876377164B3B609F2.exe 4972 2AB36B7875F2B5A876377164B3B609F2.exe 4972 2AB36B7875F2B5A876377164B3B609F2.exe 4972 2AB36B7875F2B5A876377164B3B609F2.exe 4972 2AB36B7875F2B5A876377164B3B609F2.exe 4972 2AB36B7875F2B5A876377164B3B609F2.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3620 wrote to memory of 4972 3620 2AB36B7875F2B5A876377164B3B609F2.exe 93 PID 3620 wrote to memory of 4972 3620 2AB36B7875F2B5A876377164B3B609F2.exe 93 PID 3620 wrote to memory of 4972 3620 2AB36B7875F2B5A876377164B3B609F2.exe 93 PID 3620 wrote to memory of 4972 3620 2AB36B7875F2B5A876377164B3B609F2.exe 93 PID 3620 wrote to memory of 4972 3620 2AB36B7875F2B5A876377164B3B609F2.exe 93 PID 3620 wrote to memory of 4972 3620 2AB36B7875F2B5A876377164B3B609F2.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2AB36B7875F2B5A876377164B3B609F2.exe"C:\Users\Admin\AppData\Local\Temp\2AB36B7875F2B5A876377164B3B609F2.exe"1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\2AB36B7875F2B5A876377164B3B609F2.exe"C:\Users\Admin\AppData\Local\Temp\2AB36B7875F2B5A876377164B3B609F2.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4972
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD54c2e2189b87f507edc2e72d7d55583a0
SHA11f06e340f76d41ea0d1e8560acd380a901b2a5bd
SHA25699a5f8dea08b5cf512ed888b3e533cc77c08dc644078793dc870abd8828c1bca
SHA5128b6b49e55afe8a697aaf71d975fab9e906143339827f75a57876a540d0d7b9e3cbbcdd8b5435d6198900a73895cc52d2082e66ee8cec342e72f2e427dde71600
-
Filesize
612KB
MD5f07d9977430e762b563eaadc2b94bbfa
SHA1da0a05b2b8d269fb73558dfcf0ed5c167f6d3877
SHA2564191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862
SHA5126afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf
-
Filesize
1.9MB
MD5f67d08e8c02574cbc2f1122c53bfb976
SHA16522992957e7e4d074947cad63189f308a80fcf2
SHA256c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e
SHA5122e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5
-
Filesize
220KB
MD5bf69aee53eb7e09784128e340390db21
SHA1865c14f705ff90740cfca41125503f7b09d3b02d
SHA2562e278ecc4627497ad3f5cb82afe333e221e36f464a06b9d0926583add3f5c4b3
SHA512d6ee39f91cae3960aa6f2a251649eb6f7bf213539aaee8ea9c7db511cd2e35de1c62dab75f6e94eb6c48c45c0825fad0e0073e26204f1f2868e4dfffa44cfcc0
-
Filesize
1.0MB
MD5dbf4f8dcefb8056dc6bae4b67ff810ce
SHA1bbac1dd8a07c6069415c04b62747d794736d0689
SHA25647b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68
SHA512b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1