Analysis
-
max time kernel
999s -
max time network
998s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
14-04-2024 09:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
1800 seconds
Behavioral task
behavioral2
Sample
a.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
9 signatures
1800 seconds
General
-
Target
a.exe
-
Size
604KB
-
MD5
03c5e639039fc1d30c92df7527e6e464
-
SHA1
42af028d0e3255c97626b06ae262a34b46419772
-
SHA256
012e382049b88808e2d0b26e016dc189f608deea9b6cc993ce24a57c99dd93d1
-
SHA512
43e215724d8a91c09c8a4c3c23584f4d4f39d0278e28bc918ee82fdc96ec36eb5cfb8c03491b80045d9448c6c1a775aa236a852d62117810a87aef6d32b0b84e
-
SSDEEP
12288:kwFVzgdn12PiuBWq5y6zLJ7M29SGMzmr:kAVgn+igWwVgXGMzy
Malware Config
Extracted
Family
raccoon
Version
1.7.3
Botnet
c021300d0074689fde86c87568e215c582272721
Attributes
-
url4cnc
https://tttttt.me/ch0koalpengold
rc4.plain
rc4.plain
Signatures
-
Raccoon Stealer V1 payload 4 IoCs
resource yara_rule behavioral2/memory/3136-2-0x0000000002230000-0x00000000022C1000-memory.dmp family_raccoon_v1 behavioral2/memory/3136-3-0x0000000000400000-0x00000000004AC000-memory.dmp family_raccoon_v1 behavioral2/memory/3136-4-0x0000000000400000-0x00000000004AC000-memory.dmp family_raccoon_v1 behavioral2/memory/3136-7-0x0000000002230000-0x00000000022C1000-memory.dmp family_raccoon_v1 -
Program crash 6 IoCs
pid pid_target Process procid_target 1496 3136 WerFault.exe 84 3564 3136 WerFault.exe 84 2564 3136 WerFault.exe 84 4224 3136 WerFault.exe 84 1932 3136 WerFault.exe 84 676 3136 WerFault.exe 84 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 872 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 872 taskmgr.exe Token: SeSystemProfilePrivilege 872 taskmgr.exe Token: SeCreateGlobalPrivilege 872 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe 872 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a.exe"C:\Users\Admin\AppData\Local\Temp\a.exe"1⤵PID:3136
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 7402⤵
- Program crash
PID:1496
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 7802⤵
- Program crash
PID:3564
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 7882⤵
- Program crash
PID:2564
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 7762⤵
- Program crash
PID:4224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 11962⤵
- Program crash
PID:1932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 12402⤵
- Program crash
PID:676
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3136 -ip 31361⤵PID:1532
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3136 -ip 31361⤵PID:4744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3136 -ip 31361⤵PID:3128
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3136 -ip 31361⤵PID:2540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3136 -ip 31361⤵PID:2996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3136 -ip 31361⤵PID:4956
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:872