Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 20:34
Static task
static1
Behavioral task
behavioral1
Sample
Nov Vessel Updated Notice - HMM RAON V.002W.scr
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Nov Vessel Updated Notice - HMM RAON V.002W.scr
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
REVISED ISF Simple Data Template - .TAIPEI PORT.scr
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
REVISED ISF Simple Data Template - .TAIPEI PORT.scr
Resource
win10v2004-20241007-en
General
-
Target
REVISED ISF Simple Data Template - .TAIPEI PORT.scr
-
Size
939KB
-
MD5
8f2339ea03c28445e8953c962b627a9f
-
SHA1
78bb830baac34639d32490699ff1538417c253fa
-
SHA256
223190694e03de0b3c9c95bdf8aeede128541033d3cf7bd4abeda4c17bba3d96
-
SHA512
7956bf31099d792a8a307ae721c1bd1e72892c639371850e2e67f85efa024b9278442445979324f916ff4f583320bd58ca89fe917a1c7685c48d39b1ef5fbe1a
-
SSDEEP
24576:HKQT/RPn1mpm2GmwzjZkY8HexKBwi/hMNFDWpke:zj51mdGRjZ0jhMNFqke
Malware Config
Extracted
raccoon
1.8.2
a41ffcd20150e4814320ae5f467659001fd5a10f
-
url4cnc
http://teletop.top/h_awp_1
http://teleta.top/h_awp_1
https://t.me/h_awp_1
Signatures
-
Raccoon Stealer V1 payload 6 IoCs
resource yara_rule behavioral4/memory/1820-11-0x0000000007AD0000-0x0000000007B61000-memory.dmp family_raccoon_v1 behavioral4/memory/3280-12-0x0000000000400000-0x0000000000491000-memory.dmp family_raccoon_v1 behavioral4/memory/3280-15-0x0000000000400000-0x0000000000491000-memory.dmp family_raccoon_v1 behavioral4/memory/3280-13-0x0000000000400000-0x0000000000491000-memory.dmp family_raccoon_v1 behavioral4/memory/3280-16-0x0000000000400000-0x0000000000491000-memory.dmp family_raccoon_v1 behavioral4/memory/3280-18-0x0000000000400000-0x0000000000491000-memory.dmp family_raccoon_v1 -
Raccoon family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1820 set thread context of 3280 1820 REVISED ISF Simple Data Template - .TAIPEI PORT.scr 102 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REVISED ISF Simple Data Template - .TAIPEI PORT.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REVISED ISF Simple Data Template - .TAIPEI PORT.scr -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1820 REVISED ISF Simple Data Template - .TAIPEI PORT.scr 1820 REVISED ISF Simple Data Template - .TAIPEI PORT.scr 1820 REVISED ISF Simple Data Template - .TAIPEI PORT.scr 1820 REVISED ISF Simple Data Template - .TAIPEI PORT.scr 1820 REVISED ISF Simple Data Template - .TAIPEI PORT.scr 1820 REVISED ISF Simple Data Template - .TAIPEI PORT.scr -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1820 REVISED ISF Simple Data Template - .TAIPEI PORT.scr -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1820 wrote to memory of 4000 1820 REVISED ISF Simple Data Template - .TAIPEI PORT.scr 99 PID 1820 wrote to memory of 4000 1820 REVISED ISF Simple Data Template - .TAIPEI PORT.scr 99 PID 1820 wrote to memory of 4000 1820 REVISED ISF Simple Data Template - .TAIPEI PORT.scr 99 PID 1820 wrote to memory of 4620 1820 REVISED ISF Simple Data Template - .TAIPEI PORT.scr 100 PID 1820 wrote to memory of 4620 1820 REVISED ISF Simple Data Template - .TAIPEI PORT.scr 100 PID 1820 wrote to memory of 4620 1820 REVISED ISF Simple Data Template - .TAIPEI PORT.scr 100 PID 1820 wrote to memory of 2280 1820 REVISED ISF Simple Data Template - .TAIPEI PORT.scr 101 PID 1820 wrote to memory of 2280 1820 REVISED ISF Simple Data Template - .TAIPEI PORT.scr 101 PID 1820 wrote to memory of 2280 1820 REVISED ISF Simple Data Template - .TAIPEI PORT.scr 101 PID 1820 wrote to memory of 3280 1820 REVISED ISF Simple Data Template - .TAIPEI PORT.scr 102 PID 1820 wrote to memory of 3280 1820 REVISED ISF Simple Data Template - .TAIPEI PORT.scr 102 PID 1820 wrote to memory of 3280 1820 REVISED ISF Simple Data Template - .TAIPEI PORT.scr 102 PID 1820 wrote to memory of 3280 1820 REVISED ISF Simple Data Template - .TAIPEI PORT.scr 102 PID 1820 wrote to memory of 3280 1820 REVISED ISF Simple Data Template - .TAIPEI PORT.scr 102 PID 1820 wrote to memory of 3280 1820 REVISED ISF Simple Data Template - .TAIPEI PORT.scr 102 PID 1820 wrote to memory of 3280 1820 REVISED ISF Simple Data Template - .TAIPEI PORT.scr 102 PID 1820 wrote to memory of 3280 1820 REVISED ISF Simple Data Template - .TAIPEI PORT.scr 102 PID 1820 wrote to memory of 3280 1820 REVISED ISF Simple Data Template - .TAIPEI PORT.scr 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\REVISED ISF Simple Data Template - .TAIPEI PORT.scr"C:\Users\Admin\AppData\Local\Temp\REVISED ISF Simple Data Template - .TAIPEI PORT.scr" /S1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\REVISED ISF Simple Data Template - .TAIPEI PORT.scr"C:\Users\Admin\AppData\Local\Temp\REVISED ISF Simple Data Template - .TAIPEI PORT.scr"2⤵PID:4000
-
-
C:\Users\Admin\AppData\Local\Temp\REVISED ISF Simple Data Template - .TAIPEI PORT.scr"C:\Users\Admin\AppData\Local\Temp\REVISED ISF Simple Data Template - .TAIPEI PORT.scr"2⤵PID:4620
-
-
C:\Users\Admin\AppData\Local\Temp\REVISED ISF Simple Data Template - .TAIPEI PORT.scr"C:\Users\Admin\AppData\Local\Temp\REVISED ISF Simple Data Template - .TAIPEI PORT.scr"2⤵PID:2280
-
-
C:\Users\Admin\AppData\Local\Temp\REVISED ISF Simple Data Template - .TAIPEI PORT.scr"C:\Users\Admin\AppData\Local\Temp\REVISED ISF Simple Data Template - .TAIPEI PORT.scr"2⤵
- System Location Discovery: System Language Discovery
PID:3280
-