Overview
overview
10Static
static
3Versium Re...fa.exe
windows7-x64
10Versium Re...fa.exe
windows10-2004-x64
10Versium Re...er.exe
windows7-x64
3Versium Re...er.exe
windows10-2004-x64
7Versium Re...ll.exe
windows7-x64
7Versium Re...ll.exe
windows10-2004-x64
7Versium Re...um.exe
windows7-x64
7Versium Re...um.exe
windows10-2004-x64
7Versium Re...it.exe
windows7-x64
10Versium Re...it.exe
windows10-2004-x64
10Versium Re...it.exe
windows7-x64
1Versium Re...it.exe
windows10-2004-x64
1Versium Re...ch.exe
windows7-x64
6Versium Re...ch.exe
windows10-2004-x64
6Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 20:12
Static task
static1
Behavioral task
behavioral1
Sample
Versium Research/028d53f5224f9cc8c60bd953504f1efa.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Versium Research/028d53f5224f9cc8c60bd953504f1efa.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Versium Research/Bot_Checker.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Versium Research/Bot_Checker.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Versium Research/Uninstall.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Versium Research/Uninstall.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Versium Research/Versium.exe
Resource
win7-20241023-en
Behavioral task
behavioral8
Sample
Versium Research/Versium.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Versium Research/VersiumResearch32bit.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Versium Research/VersiumResearch32bit.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Versium Research/VersiumResearch64bit.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Versium Research/VersiumResearch64bit.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Versium Research/Versiumresearch.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Versium Research/Versiumresearch.exe
Resource
win10v2004-20241007-en
General
-
Target
Versium Research/VersiumResearch32bit.exe
-
Size
504KB
-
MD5
8479bce60218cd871c118308ded82d39
-
SHA1
0388ec861b2ac5c7f4dc6eed249d92d3002fe66e
-
SHA256
15078be80772a449383c5f6a7631955039b82ebaf507ab67e61093b70b98dc43
-
SHA512
f4be47baee6baeacbe1e27174ad83700efc78ab2d02262d718c7436d2304fc16618a5911bed63ed8d2e947af3c511d17b77ddfccea9a4e6aab9f3956fcf322f8
-
SSDEEP
12288:KZCvp4LezCdIzVgs4Bi9ecBTBB85c50J3FTI:KZuKezCqzVgsy8acqBI
Malware Config
Extracted
raccoon
1.7.3
5c07c7a19b0c108c44d95accd1e1b897aa1528e1
-
url4cnc
https://telete.in/fsp1boomgasio
Signatures
-
Raccoon Stealer V1 payload 5 IoCs
resource yara_rule behavioral10/memory/3196-2-0x00000000048D0000-0x0000000004963000-memory.dmp family_raccoon_v1 behavioral10/memory/3196-3-0x0000000000400000-0x0000000000495000-memory.dmp family_raccoon_v1 behavioral10/memory/3196-5-0x00000000048D0000-0x0000000004963000-memory.dmp family_raccoon_v1 behavioral10/memory/3196-7-0x0000000000400000-0x0000000000495000-memory.dmp family_raccoon_v1 behavioral10/memory/3196-6-0x0000000000400000-0x0000000002CB4000-memory.dmp family_raccoon_v1 -
Raccoon family
-
Program crash 7 IoCs
pid pid_target Process procid_target 2952 3196 WerFault.exe 83 5108 3196 WerFault.exe 83 2196 3196 WerFault.exe 83 3416 3196 WerFault.exe 83 4880 3196 WerFault.exe 83 2816 3196 WerFault.exe 83 3936 3196 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VersiumResearch32bit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Versium Research\VersiumResearch32bit.exe"C:\Users\Admin\AppData\Local\Temp\Versium Research\VersiumResearch32bit.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3196 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 7402⤵
- Program crash
PID:2952
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 7762⤵
- Program crash
PID:5108
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 8922⤵
- Program crash
PID:2196
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 8922⤵
- Program crash
PID:3416
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 11642⤵
- Program crash
PID:4880
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 11682⤵
- Program crash
PID:2816
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 16282⤵
- Program crash
PID:3936
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3196 -ip 31961⤵PID:792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3196 -ip 31961⤵PID:2608
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3196 -ip 31961⤵PID:3596
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3196 -ip 31961⤵PID:2684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3196 -ip 31961⤵PID:4248
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3196 -ip 31961⤵PID:1076
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 3196 -ip 31961⤵PID:2688