Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
17-04-2024 06:41
Static task
static1
Behavioral task
behavioral1
Sample
fe3c627fa533eb4924e1915f2e2c8a5d07e20f8081de424d805fc850f03dba88.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
fe3c627fa533eb4924e1915f2e2c8a5d07e20f8081de424d805fc850f03dba88.exe
Resource
win10v2004-20240412-en
General
-
Target
fe3c627fa533eb4924e1915f2e2c8a5d07e20f8081de424d805fc850f03dba88.exe
-
Size
89KB
-
MD5
4689fa4b5da75c275204c36d0ef1bd0c
-
SHA1
f54b9bf584231c7d4ec8254b544de147c8c57870
-
SHA256
fe3c627fa533eb4924e1915f2e2c8a5d07e20f8081de424d805fc850f03dba88
-
SHA512
2f8844561392415d811822dcca715ff8d0527a429a218625c98dc475e082a6bb283afa08a604dd610428e35fb9c65d1eb87d32865bfa4832c15ae9e866c9eee1
-
SSDEEP
1536:WuwkW4cEmvSGLRTifUEj6PqmdZbJcfl2yRKwI8Ejhr7bqTZCEcblP8FQb:Wq8zETm/sNG88hr7bqTcE4GQb
Malware Config
Extracted
raccoon
8401e21bbb0060afb24ce21fda90f5cb
http://195.20.16.155:80
-
user_agent
MrBidenNeverKnow
Signatures
-
Raccoon Stealer V2 payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/3060-4-0x00000000022B0000-0x00000000042B0000-memory.dmp family_raccoon_v2 behavioral1/memory/2216-8-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon_v2 behavioral1/memory/2216-10-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon_v2 behavioral1/memory/2216-13-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon_v2 behavioral1/memory/2216-16-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon_v2 -
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2216-8-0x0000000000400000-0x0000000000416000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2216-10-0x0000000000400000-0x0000000000416000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2216-13-0x0000000000400000-0x0000000000416000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2216-16-0x0000000000400000-0x0000000000416000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore -
Suspicious use of SetThreadContext 1 IoCs
Processes:
fe3c627fa533eb4924e1915f2e2c8a5d07e20f8081de424d805fc850f03dba88.exedescription pid process target process PID 3060 set thread context of 2216 3060 fe3c627fa533eb4924e1915f2e2c8a5d07e20f8081de424d805fc850f03dba88.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2036 2216 WerFault.exe RegAsm.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
fe3c627fa533eb4924e1915f2e2c8a5d07e20f8081de424d805fc850f03dba88.exeRegAsm.exedescription pid process target process PID 3060 wrote to memory of 2216 3060 fe3c627fa533eb4924e1915f2e2c8a5d07e20f8081de424d805fc850f03dba88.exe RegAsm.exe PID 3060 wrote to memory of 2216 3060 fe3c627fa533eb4924e1915f2e2c8a5d07e20f8081de424d805fc850f03dba88.exe RegAsm.exe PID 3060 wrote to memory of 2216 3060 fe3c627fa533eb4924e1915f2e2c8a5d07e20f8081de424d805fc850f03dba88.exe RegAsm.exe PID 3060 wrote to memory of 2216 3060 fe3c627fa533eb4924e1915f2e2c8a5d07e20f8081de424d805fc850f03dba88.exe RegAsm.exe PID 3060 wrote to memory of 2216 3060 fe3c627fa533eb4924e1915f2e2c8a5d07e20f8081de424d805fc850f03dba88.exe RegAsm.exe PID 3060 wrote to memory of 2216 3060 fe3c627fa533eb4924e1915f2e2c8a5d07e20f8081de424d805fc850f03dba88.exe RegAsm.exe PID 3060 wrote to memory of 2216 3060 fe3c627fa533eb4924e1915f2e2c8a5d07e20f8081de424d805fc850f03dba88.exe RegAsm.exe PID 3060 wrote to memory of 2216 3060 fe3c627fa533eb4924e1915f2e2c8a5d07e20f8081de424d805fc850f03dba88.exe RegAsm.exe PID 3060 wrote to memory of 2216 3060 fe3c627fa533eb4924e1915f2e2c8a5d07e20f8081de424d805fc850f03dba88.exe RegAsm.exe PID 3060 wrote to memory of 2216 3060 fe3c627fa533eb4924e1915f2e2c8a5d07e20f8081de424d805fc850f03dba88.exe RegAsm.exe PID 3060 wrote to memory of 2216 3060 fe3c627fa533eb4924e1915f2e2c8a5d07e20f8081de424d805fc850f03dba88.exe RegAsm.exe PID 3060 wrote to memory of 2216 3060 fe3c627fa533eb4924e1915f2e2c8a5d07e20f8081de424d805fc850f03dba88.exe RegAsm.exe PID 2216 wrote to memory of 2036 2216 RegAsm.exe WerFault.exe PID 2216 wrote to memory of 2036 2216 RegAsm.exe WerFault.exe PID 2216 wrote to memory of 2036 2216 RegAsm.exe WerFault.exe PID 2216 wrote to memory of 2036 2216 RegAsm.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe3c627fa533eb4924e1915f2e2c8a5d07e20f8081de424d805fc850f03dba88.exe"C:\Users\Admin\AppData\Local\Temp\fe3c627fa533eb4924e1915f2e2c8a5d07e20f8081de424d805fc850f03dba88.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 2523⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2216-5-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2216-7-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2216-6-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2216-8-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2216-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2216-10-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2216-13-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2216-16-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/3060-0-0x0000000000170000-0x000000000018C000-memory.dmpFilesize
112KB
-
memory/3060-2-0x0000000074980000-0x000000007506E000-memory.dmpFilesize
6.9MB
-
memory/3060-4-0x00000000022B0000-0x00000000042B0000-memory.dmpFilesize
32.0MB
-
memory/3060-14-0x0000000074980000-0x000000007506E000-memory.dmpFilesize
6.9MB