Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
13-04-2024 01:03
Static task
static1
Behavioral task
behavioral1
Sample
1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe
Resource
win10v2004-20240412-en
General
-
Target
1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe
-
Size
89KB
-
MD5
d0fa79fc637c5916da8d7c2f07948933
-
SHA1
d4fb639fe811739c4adf2e62b5df1f8c9ab35c75
-
SHA256
1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9
-
SHA512
68bca697a0cb607b6d813ddd4656afaa617384dbbafecda6b4f03685da8fba8603d761e0cb56841a778e59908064ff93261e80bc2f19f6898240d0b2dd65dd4c
-
SSDEEP
1536:2PX4YBLPitzZgglqlwEmnFN+br133phXZ4gDjyAKrsTBLviJYPx5OSbDU9oBdh02:ZzZggAlwEAAbryXsTBTiJYPx5OSbEoBN
Malware Config
Extracted
raccoon
8401e21bbb0060afb24ce21fda90f5cb
http://195.20.16.155:80
-
user_agent
MrBidenNeverKnow
Signatures
-
Raccoon Stealer V2 payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2308-5-0x0000000002100000-0x0000000004100000-memory.dmp family_raccoon_v2 behavioral1/memory/2380-8-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon_v2 behavioral1/memory/2380-10-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon_v2 behavioral1/memory/2380-14-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon_v2 behavioral1/memory/2380-16-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon_v2 -
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2380-8-0x0000000000400000-0x0000000000416000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2380-10-0x0000000000400000-0x0000000000416000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2380-14-0x0000000000400000-0x0000000000416000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2380-16-0x0000000000400000-0x0000000000416000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exedescription pid process target process PID 2308 set thread context of 2380 2308 1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3028 2380 WerFault.exe RegAsm.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exeRegAsm.exedescription pid process target process PID 2308 wrote to memory of 2380 2308 1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe RegAsm.exe PID 2308 wrote to memory of 2380 2308 1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe RegAsm.exe PID 2308 wrote to memory of 2380 2308 1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe RegAsm.exe PID 2308 wrote to memory of 2380 2308 1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe RegAsm.exe PID 2308 wrote to memory of 2380 2308 1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe RegAsm.exe PID 2308 wrote to memory of 2380 2308 1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe RegAsm.exe PID 2308 wrote to memory of 2380 2308 1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe RegAsm.exe PID 2308 wrote to memory of 2380 2308 1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe RegAsm.exe PID 2308 wrote to memory of 2380 2308 1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe RegAsm.exe PID 2308 wrote to memory of 2380 2308 1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe RegAsm.exe PID 2308 wrote to memory of 2380 2308 1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe RegAsm.exe PID 2308 wrote to memory of 2380 2308 1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe RegAsm.exe PID 2380 wrote to memory of 3028 2380 RegAsm.exe WerFault.exe PID 2380 wrote to memory of 3028 2380 RegAsm.exe WerFault.exe PID 2380 wrote to memory of 3028 2380 RegAsm.exe WerFault.exe PID 2380 wrote to memory of 3028 2380 RegAsm.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe"C:\Users\Admin\AppData\Local\Temp\1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 2523⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2308-0-0x0000000000970000-0x000000000098C000-memory.dmpFilesize
112KB
-
memory/2308-2-0x0000000074A80000-0x000000007516E000-memory.dmpFilesize
6.9MB
-
memory/2308-5-0x0000000002100000-0x0000000004100000-memory.dmpFilesize
32.0MB
-
memory/2308-13-0x0000000074A80000-0x000000007516E000-memory.dmpFilesize
6.9MB
-
memory/2380-4-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2380-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2380-8-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2380-7-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2380-6-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2380-10-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2380-14-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2380-16-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB