raccoon | 8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3

Analysis

max time kernel
151s
max time network
135s
platform
windows10_x64
resource
win10-en-20210920
submitted
24-10-2021 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe
Size

336KB
MD5

ce3b37511bcf0f509b20f5ca0085badb
SHA1

cc0dd74710fa5c1cb8b78a8ddb05ab8eceb3f9a0
SHA256

8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3
SHA512

c549b2de885731127a97624667b1a7104a3332b3d91ed4ce58f051fa171882ec6e9d26f7005cf44efd1bb36ed4543c9d397e721b71c2b3c09c570adb52fe9c61

Score

10^/10

raccoon redline smokeloader 7ebf9b416b72a203df65383eec899dc689d2c3d7 backdoor discovery infostealer spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://xacokuo8.top/

http://hajezey1.top/

rc4.i32

Extracted

Family

raccoon

Botnet

7ebf9b416b72a203df65383eec899dc689d2c3d7

Attributes

url4cnc
http://telegatt.top/agrybirdsgamerept

http://telegka.top/agrybirdsgamerept

http://telegin.top/agrybirdsgamerept

https://t.me/agrybirdsgamerept

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/684-134-0x0000000000418D06-mapping.dmp	family_redline
behavioral1/memory/684-133-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 2412 created 1936 2412 WerFault.exe CC18.exe
Downloads MZ/PE file
Executes dropped EXE 5 IoCs

Processes:

3593.exe3593.exe5001.exe5001.exeCC18.exe

pid process

3980 3593.exe
1020 3593.exe
2776 5001.exe
684 5001.exe
1936 CC18.exe
Deletes itself 1 IoCs

Processes:

pid process

3036
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

description	pid	process	target process
PID 2412 created 1936	2412	WerFault.exe	CC18.exe

pid	process
3980	3593.exe
1020	3593.exe
2776	5001.exe
684	5001.exe
1936	CC18.exe

pid	process
3036

Suspicious use of SetThreadContext 3 IoCs

Processes:

8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe3593.exe5001.exe

description	pid	process	target process
PID 3224 set thread context of 3308	3224	8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe	8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe
PID 3980 set thread context of 1020	3980	3593.exe	3593.exe
PID 2776 set thread context of 684	2776	5001.exe	5001.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2412 1936 WerFault.exe CC18.exe

pid	pid_target	process	target process
2412	1936	WerFault.exe	CC18.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

3593.exe8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3593.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3593.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe

pid	process
3308	8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe
3308	8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3036
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe3593.exe

pid process

3308 8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe
1020 3593.exe

pid	process
3036

Suspicious use of AdjustPrivilegeToken 30 IoCs

Processes:

5001.exeWerFault.exe

description	pid	process
Token: SeShutdownPrivilege	3036
Token: SeCreatePagefilePrivilege	3036
Token: SeShutdownPrivilege	3036
Token: SeCreatePagefilePrivilege	3036
Token: SeShutdownPrivilege	3036
Token: SeCreatePagefilePrivilege	3036
Token: SeShutdownPrivilege	3036
Token: SeCreatePagefilePrivilege	3036
Token: SeShutdownPrivilege	3036
Token: SeCreatePagefilePrivilege	3036
Token: SeShutdownPrivilege	3036
Token: SeCreatePagefilePrivilege	3036
Token: SeShutdownPrivilege	3036
Token: SeCreatePagefilePrivilege	3036
Token: SeDebugPrivilege	684	5001.exe
Token: SeShutdownPrivilege	3036
Token: SeCreatePagefilePrivilege	3036
Token: SeShutdownPrivilege	3036
Token: SeCreatePagefilePrivilege	3036
Token: SeShutdownPrivilege	3036
Token: SeCreatePagefilePrivilege	3036
Token: SeShutdownPrivilege	3036
Token: SeCreatePagefilePrivilege	3036
Token: SeRestorePrivilege	2412	WerFault.exe
Token: SeBackupPrivilege	2412	WerFault.exe
Token: SeDebugPrivilege	2412	WerFault.exe
Token: SeShutdownPrivilege	3036
Token: SeCreatePagefilePrivilege	3036
Token: SeShutdownPrivilege	3036
Token: SeCreatePagefilePrivilege	3036

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe3593.exe5001.exe

description	pid	process	target process
PID 3224 wrote to memory of 3308	3224	8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe	8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe
PID 3224 wrote to memory of 3308	3224	8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe	8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe
PID 3224 wrote to memory of 3308	3224	8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe	8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe
PID 3224 wrote to memory of 3308	3224	8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe	8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe
PID 3224 wrote to memory of 3308	3224	8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe	8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe
PID 3224 wrote to memory of 3308	3224	8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe	8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe
PID 3036 wrote to memory of 3980	3036		3593.exe
PID 3036 wrote to memory of 3980	3036		3593.exe
PID 3036 wrote to memory of 3980	3036		3593.exe
PID 3980 wrote to memory of 1020	3980	3593.exe	3593.exe
PID 3980 wrote to memory of 1020	3980	3593.exe	3593.exe
PID 3980 wrote to memory of 1020	3980	3593.exe	3593.exe
PID 3980 wrote to memory of 1020	3980	3593.exe	3593.exe
PID 3980 wrote to memory of 1020	3980	3593.exe	3593.exe
PID 3980 wrote to memory of 1020	3980	3593.exe	3593.exe
PID 3036 wrote to memory of 2776	3036		5001.exe
PID 3036 wrote to memory of 2776	3036		5001.exe
PID 3036 wrote to memory of 2776	3036		5001.exe
PID 2776 wrote to memory of 684	2776	5001.exe	5001.exe
PID 2776 wrote to memory of 684	2776	5001.exe	5001.exe
PID 2776 wrote to memory of 684	2776	5001.exe	5001.exe
PID 2776 wrote to memory of 684	2776	5001.exe	5001.exe
PID 2776 wrote to memory of 684	2776	5001.exe	5001.exe
PID 2776 wrote to memory of 684	2776	5001.exe	5001.exe
PID 2776 wrote to memory of 684	2776	5001.exe	5001.exe
PID 2776 wrote to memory of 684	2776	5001.exe	5001.exe
PID 3036 wrote to memory of 1936	3036		CC18.exe
PID 3036 wrote to memory of 1936	3036		CC18.exe
PID 3036 wrote to memory of 1936	3036		CC18.exe

C:\Users\Admin\AppData\Local\Temp\8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe
"C:\Users\Admin\AppData\Local\Temp\8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3224

C:\Users\Admin\AppData\Local\Temp\8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe
"C:\Users\Admin\AppData\Local\Temp\8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3308

C:\Users\Admin\AppData\Local\Temp\3593.exe
C:\Users\Admin\AppData\Local\Temp\3593.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3980

C:\Users\Admin\AppData\Local\Temp\3593.exe
C:\Users\Admin\AppData\Local\Temp\3593.exe
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1020

C:\Users\Admin\AppData\Local\Temp\5001.exe
C:\Users\Admin\AppData\Local\Temp\5001.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2776

C:\Users\Admin\AppData\Local\Temp\5001.exe
C:\Users\Admin\AppData\Local\Temp\5001.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:684

C:\Users\Admin\AppData\Local\Temp\CC18.exe
C:\Users\Admin\AppData\Local\Temp\CC18.exe
1⤵
- Executes dropped EXE
PID:1936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 852
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2412

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5001.exe.log
MD5
605f809fab8c19729d39d075f7ffdb53

SHA1
c546f877c9bd53563174a90312a8337fdfc5fdd9

SHA256
6904d540649e76c55f99530b81be17e099184bb4cad415aa9b9b39cc3677f556

SHA512
82cc12c3186ae23884b8d5c104638c8206272c4389ade56b926dfc1d437b03888159b3c790b188b54d277a262e731927e703e680ea642e1417faee27443fd5b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\3593.exe
MD5
ce3b37511bcf0f509b20f5ca0085badb

SHA1
cc0dd74710fa5c1cb8b78a8ddb05ab8eceb3f9a0

SHA256
8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3

SHA512
c549b2de885731127a97624667b1a7104a3332b3d91ed4ce58f051fa171882ec6e9d26f7005cf44efd1bb36ed4543c9d397e721b71c2b3c09c570adb52fe9c61

Download Submit
C:\Users\Admin\AppData\Local\Temp\3593.exe
MD5
ce3b37511bcf0f509b20f5ca0085badb

SHA1
cc0dd74710fa5c1cb8b78a8ddb05ab8eceb3f9a0

SHA256
8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3

SHA512
c549b2de885731127a97624667b1a7104a3332b3d91ed4ce58f051fa171882ec6e9d26f7005cf44efd1bb36ed4543c9d397e721b71c2b3c09c570adb52fe9c61

Download Submit
C:\Users\Admin\AppData\Local\Temp\3593.exe
MD5
ce3b37511bcf0f509b20f5ca0085badb

SHA1
cc0dd74710fa5c1cb8b78a8ddb05ab8eceb3f9a0

SHA256
8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3

SHA512
c549b2de885731127a97624667b1a7104a3332b3d91ed4ce58f051fa171882ec6e9d26f7005cf44efd1bb36ed4543c9d397e721b71c2b3c09c570adb52fe9c61

Download Submit
C:\Users\Admin\AppData\Local\Temp\5001.exe
MD5
a9cf6b07b6ee36d4986bd67429634417

SHA1
5343ed7b750d6f4b4710380bbd14301936db982e

SHA256
56ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5

SHA512
4e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\5001.exe
MD5
a9cf6b07b6ee36d4986bd67429634417

SHA1
5343ed7b750d6f4b4710380bbd14301936db982e

SHA256
56ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5

SHA512
4e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\5001.exe
MD5
a9cf6b07b6ee36d4986bd67429634417

SHA1
5343ed7b750d6f4b4710380bbd14301936db982e

SHA256
56ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5

SHA512
4e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CC18.exe
MD5
cfe698927cffa57588b0d86d1663f19a

SHA1
19b67410923e589ad3a3c560e35b733e01fe40b2

SHA256
c57897485abec1f54b3f54c762777cd2b8fb09d79282388a8b30bb1216052361

SHA512
984b12091b376797d2350e9a10fe8b88de4c99815f6dd887d678384649bced4e3e89f65db05fc767e280c80bcea7f101ae399d38d7e8b6a9ab3c6a27ebcbb6b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CC18.exe
MD5
cfe698927cffa57588b0d86d1663f19a

SHA1
19b67410923e589ad3a3c560e35b733e01fe40b2

SHA256
c57897485abec1f54b3f54c762777cd2b8fb09d79282388a8b30bb1216052361

SHA512
984b12091b376797d2350e9a10fe8b88de4c99815f6dd887d678384649bced4e3e89f65db05fc767e280c80bcea7f101ae399d38d7e8b6a9ab3c6a27ebcbb6b9

Download Submit
memory/684-148-0x00000000062A0000-0x00000000062A1000-memory.dmp

Filesize
4KB

Download
memory/684-149-0x0000000006DD0000-0x0000000006DD1000-memory.dmp

Filesize
4KB

Download
memory/684-150-0x00000000074D0000-0x00000000074D1000-memory.dmp

Filesize
4KB

Download
memory/684-147-0x00000000062D0000-0x00000000062D1000-memory.dmp

Filesize
4KB

Download
memory/684-146-0x00000000061B0000-0x00000000061B1000-memory.dmp

Filesize
4KB

Download
memory/684-134-0x0000000000418D06-mapping.dmp

Download
memory/684-133-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/684-145-0x0000000006600000-0x0000000006601000-memory.dmp

Filesize
4KB

Download
memory/684-138-0x00000000058F0000-0x00000000058F1000-memory.dmp

Filesize
4KB

Download
memory/684-139-0x0000000005350000-0x0000000005351000-memory.dmp

Filesize
4KB

Download
memory/684-140-0x0000000005480000-0x0000000005481000-memory.dmp

Filesize
4KB

Download
memory/684-141-0x00000000053B0000-0x00000000053B1000-memory.dmp

Filesize
4KB

Download
memory/684-142-0x00000000053F0000-0x00000000053F1000-memory.dmp

Filesize
4KB

Download
memory/684-143-0x00000000052E0000-0x00000000058E6000-memory.dmp

Filesize
6.0MB

Download
memory/684-144-0x0000000005740000-0x0000000005741000-memory.dmp

Filesize
4KB

Download
memory/1020-125-0x0000000000402E0C-mapping.dmp

Download
memory/1936-155-0x0000000001391000-0x00000000013E0000-memory.dmp

Filesize
316KB

Download
memory/1936-156-0x0000000001220000-0x00000000012AE000-memory.dmp

Filesize
568KB

Download
memory/1936-152-0x0000000000000000-mapping.dmp

Download
memory/1936-157-0x0000000000400000-0x0000000001063000-memory.dmp

Filesize
12.4MB

Download
memory/2776-131-0x00000000007B0000-0x00000000007B1000-memory.dmp

Filesize
4KB

Download
memory/2776-128-0x0000000000000000-mapping.dmp

Download
memory/3036-127-0x0000000002820000-0x0000000002836000-memory.dmp

Filesize
88KB

Download
memory/3036-119-0x0000000000DF0000-0x0000000000E06000-memory.dmp

Filesize
88KB

Download
memory/3224-118-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/3308-116-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3308-117-0x0000000000402E0C-mapping.dmp

Download
memory/3980-120-0x0000000000000000-mapping.dmp

Download