popup

Report - a03.exe

Raccoon Stealer Gen1 Gen2 Malicious Library Malicious Packer VMProtect UPX AntiDebug AntiVM PE File PE32 OS Processor Check DLL PNG Format JPEG Format
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.05.24 09:14 Machine s1_win7_x6403
Filename a03.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
4
 Behavior Score
15.6
ZERO API file : malware
VT API (file) 42 detected (AIDetectMalware, Raccoon, Fragtor, V5se, TrojanPSW, malicious, Attribute, HighConfidence, moderate confidence, multiple detections, score, QQPass, QQRob, Psmw, Nekark, lfcoo, Static AI, Malicious PE, ai score=82, CREC, Artemis, BScope, unsafe, Generic@AI, RDML, fhOnm, Nd8ag8Z8AxoUg, ZexaF, @tW@a41Ad8ji, confidence)
md5 02eceb12980e60c1496eb6b9a02d3483
sha256 e36099a8ffebc501c3d1b8325a103b62769c5ac2630989ea3ea66715022a062f
ssdeep 98304:z4S0clXTS9EIv1281Ey0l6iEz0JzA3+rBAlrHC3dNtCLChF:l/lX3I9R1EFlnxJzVA1ALI+hF
imphash 9f8af27f520ea359d999bd8cba16dec6
impfuzzy 24:HDogrlY3Um8dkt/Oov/Gy2cfh/J3I+FQHRyv0T4cjMDM21jYTmqyyjmNzbR1FhyX:cUpGt2MGDcfjb0ctqmPoehNz5n8
  Network IP location

Signature (32cnts)

Level Description
danger File has been identified by 42 AntiVirus engines on VirusTotal as malicious
danger Executed a process and injected code into it
warning Generates some ICMP traffic
watch Allocates execute permission to another process indicative of possible code injection
watch Attempts to create or modify system certificates
watch Checks for the presence of known windows from debuggers and forensic tools
watch Collects information about installed applications
watch Communicates with host for which no DNS query was performed
watch Installs itself for autorun at Windows startup
watch One or more of the buffers contains an embedded PE file
watch Resumed a suspended thread in a remote process potentially indicative of process injection
watch Used NtSetContextThread to modify a thread in a remote process indicative of process injection
notice A process created a hidden window
notice Allocates read-write-execute memory (usually to unpack itself)
notice An executable file was downloaded by the process 2.1.1.exe
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Creates executable files on the filesystem
notice Creates hidden or system file
notice Drops an executable to the user AppData folder
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice Queries for potentially installed applications
notice Sends data using the HTTP POST Method
notice Steals private information from local Internet browsers
notice The binary likely contains encrypted or compressed data indicative of a packer
notice Uses Windows utilities for basic Windows functionality
notice Yara rule detected in process memory
info Checks amount of memory in system
info Collects information to fingerprint the system (MachineGuid
info Command line console output was observed
info Tries to locate where the browsers are installed

Rules (28cnts)

Level Name Description Collection
danger Raccoon_Stealer_1_Zero Raccoon Stealer binaries (download)
danger Raccoon_Stealer_1_Zero Raccoon Stealer binaries (upload)
danger Win32_Trojan_Gen_1_0904B0_Zero Win32 Trojan Emotet binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (download)
watch Malicious_Packer_Zero Malicious Packer binaries (upload)
watch UPX_Zero UPX packed file binaries (download)
watch VMProtect_Zero VMProtect packed file binaries (download)
watch VMProtect_Zero VMProtect packed file binaries (upload)
info anti_dbg Checks if being debugged memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info IsDLL (no description) binaries (download)
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info JPEG_Format_Zero JPEG Format binaries (download)
info OS_Processor_Check_Zero OS Processor Check binaries (download)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)
info PNG_Format_Zero PNG Format binaries (download)
info SEH__vba (no description) memory
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory
info Win32_Trojan_Gen_2_0904B0_Zero Win32 Trojan Gen binaries (download)

Network (15cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://45.144.28.189/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
whois
GB A.b Internet Solutions 45.144.28.189 clean
http://45.144.28.189/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll
whois
GB A.b Internet Solutions 45.144.28.189 clean
http://45.144.28.189/302f831c3b8545fb0a5a60bd7a5eeedb
whois
GB A.b Internet Solutions 45.144.28.189 clean
http://45.144.28.189/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
whois
GB A.b Internet Solutions 45.144.28.189 clean
http://45.144.28.189/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
whois
GB A.b Internet Solutions 45.144.28.189 clean
http://45.144.28.189/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
whois
GB A.b Internet Solutions 45.144.28.189 clean
http://45.144.28.189/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll
whois
GB A.b Internet Solutions 45.144.28.189 clean
http://45.144.28.189/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
whois
GB A.b Internet Solutions 45.144.28.189 clean
http://45.144.28.189/
whois
GB A.b Internet Solutions 45.144.28.189 clean
https://14mmf.za.com/analytics.php?pub=a03&guid=017bd04f-b3bf-45b6-8167-9e8f41ff87bf&sign=178004f0465ebfb5
whois
US CLOUDFLARENET 172.67.223.30 clean
iplogger.com
whois
DE Hetzner Online GmbH 148.251.234.93 mailcious
14mmf.za.com
whois
US CLOUDFLARENET 172.67.223.30 clean
148.251.234.93
whois
DE Hetzner Online GmbH 148.251.234.93 mailcious
172.67.223.30
whois
US CLOUDFLARENET 172.67.223.30 clean
45.144.28.189
whois
GB A.b Internet Solutions 45.144.28.189 clean

Suricata ids

ET INFO TLS Handshake Failure
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
ET MALWARE Win32/RecordBreaker CnC Checkin M1
ET MALWARE Win32/RecordBreaker CnC Checkin - Server Response
ET INFO Dotted Quad Host DLL Request
ET POLICY PE EXE or DLL Windows file download HTTP
ET HUNTING Possible Generic Stealer Sending System Information
ET HUNTING Possible Generic Stealer Sending a Screenshot

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x40f03c CreateProcessA
 0x40f040 MultiByteToWideChar
 0x40f044 GetProcAddress
 0x40f048 LoadLibraryA
 0x40f04c GetModuleFileNameA
 0x40f050 WinExec
 0x40f054 CloseHandle
 0x40f058 WideCharToMultiByte
 0x40f05c WriteFile
 0x40f060 GetSystemTime
 0x40f064 ReadFile
 0x40f068 FlushFileBuffers
 0x40f06c GetFileTime
 0x40f070 GetLastError
 0x40f074 SystemTimeToFileTime
 0x40f078 CreateFileA
 0x40f07c GetTempPathA
 0x40f080 Sleep
 0x40f084 CreateMutexA
 0x40f088 ExitProcess
 0x40f08c GetLocaleInfoA
 0x40f090 GetStringTypeW
 0x40f094 GetStringTypeA
 0x40f098 LCMapStringW
 0x40f09c LCMapStringA
 0x40f0a0 WriteConsoleW
 0x40f0a4 GetConsoleOutputCP
 0x40f0a8 WriteConsoleA
 0x40f0ac SetStdHandle
 0x40f0b0 InitializeCriticalSection
 0x40f0b4 HeapFree
 0x40f0b8 HeapAlloc
 0x40f0bc TerminateProcess
 0x40f0c0 GetCurrentProcess
 0x40f0c4 UnhandledExceptionFilter
 0x40f0c8 SetUnhandledExceptionFilter
 0x40f0cc IsDebuggerPresent
 0x40f0d0 GetCommandLineA
 0x40f0d4 GetVersionExA
 0x40f0d8 GetProcessHeap
 0x40f0dc GetStartupInfoA
 0x40f0e0 RaiseException
 0x40f0e4 RtlUnwind
 0x40f0e8 HeapDestroy
 0x40f0ec HeapCreate
 0x40f0f0 VirtualFree
 0x40f0f4 DeleteCriticalSection
 0x40f0f8 LeaveCriticalSection
 0x40f0fc EnterCriticalSection
 0x40f100 VirtualAlloc
 0x40f104 HeapReAlloc
 0x40f108 GetModuleHandleA
 0x40f10c GetStdHandle
 0x40f110 TlsGetValue
 0x40f114 TlsAlloc
 0x40f118 TlsSetValue
 0x40f11c TlsFree
 0x40f120 InterlockedIncrement
 0x40f124 SetLastError
 0x40f128 GetCurrentThreadId
 0x40f12c InterlockedDecrement
 0x40f130 FreeEnvironmentStringsA
 0x40f134 GetEnvironmentStrings
 0x40f138 FreeEnvironmentStringsW
 0x40f13c GetEnvironmentStringsW
 0x40f140 SetHandleCount
 0x40f144 GetFileType
 0x40f148 QueryPerformanceCounter
 0x40f14c GetTickCount
 0x40f150 GetCurrentProcessId
 0x40f154 GetSystemTimeAsFileTime
 0x40f158 HeapSize
 0x40f15c SetFilePointer
 0x40f160 GetConsoleCP
 0x40f164 GetConsoleMode
 0x40f168 GetCPInfo
 0x40f16c GetACP
 0x40f170 GetOEMCP
ADVAPI32.dll
 0x40f000 RegCloseKey
 0x40f004 RegOpenKeyExA
 0x40f008 RegQueryValueExA
 0x40f00c InitializeSecurityDescriptor
 0x40f010 SetSecurityDescriptorDacl
 0x40f014 RegCreateKeyExA
SHELL32.dll
 0x40f178 SHGetSpecialFolderPathA
SHLWAPI.dll
 0x40f180 PathFileExistsA
CRYPT32.dll
 0x40f01c CryptStringToBinaryA
 0x40f020 CertOpenStore
 0x40f024 CertFreeCertificateContext
 0x40f028 CertAddCertificateContextToStore
 0x40f02c CertCloseStore
 0x40f030 CertCreateCertificateContext
 0x40f034 CertGetCertificateContextProperty
WINHTTP.dll
 0x40f188 WinHttpQueryHeaders
 0x40f18c WinHttpCloseHandle
 0x40f190 WinHttpConnect
 0x40f194 WinHttpQueryDataAvailable
 0x40f198 WinHttpOpenRequest
 0x40f19c WinHttpSetTimeouts
 0x40f1a0 WinHttpReceiveResponse
 0x40f1a4 WinHttpQueryOption
 0x40f1a8 WinHttpOpen
 0x40f1ac WinHttpAddRequestHeaders
 0x40f1b0 WinHttpSetOption
 0x40f1b4 WinHttpReadData
 0x40f1b8 WinHttpSendRequest

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure