raccoon | e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cfbf9fc9ed24d8dc7d143

Analysis

max time kernel
150s
max time network
130s
platform
windows7_x64
resource
win7-en-20210920
submitted
24-09-2021 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe
Size

287KB
MD5

6cbf95206889d06445d284b862cf18bf
SHA1

c85b2f93e81da0d5759f195afdf91a645343fe5d
SHA256

e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cfbf9fc9ed24d8dc7d143
SHA512

45d81eddf9e9c38ed9b8ec6510b6b34c752c5ccc01e22028549ef19921308a8531dbb8c5f9f79833e5df350dd47dc2a3edd430926d45f4f1f31fd329c50393e4

Score

10^/10

raccoon redline smokeloader 2k superstar 5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4 backdoor discovery infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/

rc4.i32

Extracted

Family

redline

Botnet

2k superstar

185.244.180.224:39957

Extracted

Family

raccoon

Botnet

5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4

Attributes

url4cnc
https://t.me/agrybirdsgamerept

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1884-70-0x0000000002C90000-0x0000000002CAF000-memory.dmp	family_redline
behavioral1/memory/1884-71-0x0000000003040000-0x000000000305E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Executes dropped EXE 3 IoCs

Processes:

1006.exe140D.exe195B.exe

pid	Process
1884	1006.exe
964	140D.exe
588	195B.exe

Deletes itself 1 IoCs

Processes:

pid	Process
1400

Drops startup file 1 IoCs

Processes:

140D.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\140D.vbs	140D.exe

Loads dropped DLL 1 IoCs

Processes:

pid	Process
1400

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

140D.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\140D = "\"C:\\Users\\Admin\\AppData\\Roaming\\140D.exe\""	140D.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

Processes:

e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe

description	pid	Process	procid_target
PID 1504 set thread context of 1572	1504	e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe	27

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe

pid	Process
1572	e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe
1572	e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid	Process
1400

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe

pid	Process
1572	e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

1006.exe140D.exe

description	pid	Process
Token: SeShutdownPrivilege	1400
Token: SeShutdownPrivilege	1400
Token: SeShutdownPrivilege	1400
Token: SeShutdownPrivilege	1400
Token: SeShutdownPrivilege	1400
Token: SeDebugPrivilege	1884	1006.exe
Token: SeDebugPrivilege	964	140D.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

pid	Process
1400
1400
1400
1400
1400
1400

Suspicious use of SendNotifyMessage 10 IoCs

Processes:

pid	Process
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe

description	pid	Process	procid_target
PID 1504 wrote to memory of 1572	1504	e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe	27
PID 1504 wrote to memory of 1572	1504	e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe	27
PID 1504 wrote to memory of 1572	1504	e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe	27
PID 1504 wrote to memory of 1572	1504	e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe	27
PID 1504 wrote to memory of 1572	1504	e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe	27
PID 1504 wrote to memory of 1572	1504	e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe	27
PID 1504 wrote to memory of 1572	1504	e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe	27
PID 1400 wrote to memory of 1884	1400		28
PID 1400 wrote to memory of 1884	1400		28
PID 1400 wrote to memory of 1884	1400		28
PID 1400 wrote to memory of 1884	1400		28
PID 1400 wrote to memory of 964	1400		30
PID 1400 wrote to memory of 964	1400		30
PID 1400 wrote to memory of 964	1400		30
PID 1400 wrote to memory of 588	1400		31
PID 1400 wrote to memory of 588	1400		31
PID 1400 wrote to memory of 588	1400		31
PID 1400 wrote to memory of 588	1400		31

C:\Users\Admin\AppData\Local\Temp\e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe
"C:\Users\Admin\AppData\Local\Temp\e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Users\Admin\AppData\Local\Temp\e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe
  "C:\Users\Admin\AppData\Local\Temp\e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1572

C:\Users\Admin\AppData\Local\Temp\1006.exe
C:\Users\Admin\AppData\Local\Temp\1006.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1884

C:\Users\Admin\AppData\Local\Temp\140D.exe
C:\Users\Admin\AppData\Local\Temp\140D.exe
1⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:964

C:\Users\Admin\AppData\Local\Temp\195B.exe
C:\Users\Admin\AppData\Local\Temp\195B.exe
1⤵
- Executes dropped EXE
PID:588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1006.exe

MD5
4266f72b05afa83f395e890b76eadf69

SHA1
489386ba56760821f6e35712028410da476fe258

SHA256
6b1e04d8ef0395166da7d784c80ec3b8e85593ec862e54c07976ef14b28c70e4

SHA512
a375f17bc9283e7edb8f492d616ec3f192d9943251a4323138c99b565dbb03a5734b4116b7b47830680dea16713155cb96e51ea32ce96f479c48e9bd0bb9556a

Download Submit
C:\Users\Admin\AppData\Local\Temp\140D.exe

MD5
0a465be9c75469e6f2398b2668a2c5f2

SHA1
9b610498a08345fe3280b6c79ed4b5d1945d6a79

SHA256
eca0040a928bb7f215b2379bf40b65397d4ead565ab8ad9a19c61740228e9f33

SHA512
eaa28aafc65e1d847f292e9e43279913b737bfb6649758548df11ebbb3de7c8c6c8e0568091b7f4261feea14a63e2dac68cb7bc1c4c0c1ef517a14f6a02873c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\140D.exe

MD5
0a465be9c75469e6f2398b2668a2c5f2

SHA1
9b610498a08345fe3280b6c79ed4b5d1945d6a79

SHA256
eca0040a928bb7f215b2379bf40b65397d4ead565ab8ad9a19c61740228e9f33

SHA512
eaa28aafc65e1d847f292e9e43279913b737bfb6649758548df11ebbb3de7c8c6c8e0568091b7f4261feea14a63e2dac68cb7bc1c4c0c1ef517a14f6a02873c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\195B.exe

MD5
1d16e9a8731a898b05829797b937c57d

SHA1
fc08c31f5581a1cee371131ec28f02fde864562c

SHA256
4237784e386651ca80bf952a1cb3affb27d33ce897336516cc0eca0896eb5bdc

SHA512
89a432eaaaf0ee07a1d76f27b6d6d06e99b5850e087d07e1f115dc4c7147a69423cf4922b5337cdf6e18e13c4eda125d0fa640b89391375bc8a89e5649c69a8a

Download Submit
\Users\Admin\AppData\Local\Temp\140D.exe

MD5
0a465be9c75469e6f2398b2668a2c5f2

SHA1
9b610498a08345fe3280b6c79ed4b5d1945d6a79

SHA256
eca0040a928bb7f215b2379bf40b65397d4ead565ab8ad9a19c61740228e9f33

SHA512
eaa28aafc65e1d847f292e9e43279913b737bfb6649758548df11ebbb3de7c8c6c8e0568091b7f4261feea14a63e2dac68cb7bc1c4c0c1ef517a14f6a02873c9

Download Submit
memory/588-78-0x0000000000400000-0x0000000002BD0000-memory.dmp

Filesize
39.8MB

Download
memory/588-77-0x0000000002BD0000-0x0000000002C60000-memory.dmp

Filesize
576KB

Download
memory/588-68-0x0000000000000000-mapping.dmp

Download
memory/964-61-0x0000000000000000-mapping.dmp

Download
memory/964-79-0x000000001B7D0000-0x000000001B853000-memory.dmp

Filesize
524KB

Download
memory/964-85-0x000000001AC16000-0x000000001AC35000-memory.dmp

Filesize
124KB

Download
memory/964-64-0x000000013F270000-0x000000013F271000-memory.dmp

Filesize
4KB

Download
memory/964-84-0x000000001BCC0000-0x000000001BD06000-memory.dmp

Filesize
280KB

Download
memory/964-83-0x000000001B370000-0x000000001B3BF000-memory.dmp

Filesize
316KB

Download
memory/964-82-0x0000000000580000-0x0000000000585000-memory.dmp

Filesize
20KB

Download
memory/964-81-0x0000000002200000-0x000000000224E000-memory.dmp

Filesize
312KB

Download
memory/964-80-0x000000001AC10000-0x000000001AC12000-memory.dmp

Filesize
8KB

Download
memory/1400-57-0x0000000002AF0000-0x0000000002B06000-memory.dmp

Filesize
88KB

Download
memory/1504-54-0x0000000000020000-0x0000000000029000-memory.dmp

Filesize
36KB

Download
memory/1572-53-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1572-56-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/1572-55-0x0000000000402FA5-mapping.dmp

Download
memory/1884-75-0x00000000070A4000-0x00000000070A6000-memory.dmp

Filesize
8KB

Download
memory/1884-73-0x00000000070A2000-0x00000000070A3000-memory.dmp

Filesize
4KB

Download
memory/1884-71-0x0000000003040000-0x000000000305E000-memory.dmp

Filesize
120KB

Download
memory/1884-70-0x0000000002C90000-0x0000000002CAF000-memory.dmp

Filesize
124KB

Download
memory/1884-72-0x00000000070A1000-0x00000000070A2000-memory.dmp

Filesize
4KB

Download
memory/1884-74-0x00000000070A3000-0x00000000070A4000-memory.dmp

Filesize
4KB

Download
memory/1884-67-0x0000000000400000-0x0000000002BA3000-memory.dmp

Filesize
39.6MB

Download
memory/1884-66-0x0000000000220000-0x0000000000250000-memory.dmp

Filesize
192KB

Download
memory/1884-58-0x0000000000000000-mapping.dmp

Download