raccoon | 1476d6de5655cd75b02e84ab01a69d62220888e48bce181511a24401f864cdcb

General

Target

1476d6de5655cd75b02e84ab01a69d62220888e48bce181511a24401f864cdcb.exe
Size

3.0MB
MD5

ca276fd46d543ceaf2af9b94f22aa7c7
SHA1

30ce7c040a08f63d8c34e0f574c7605ac767ec4e
SHA256

1476d6de5655cd75b02e84ab01a69d62220888e48bce181511a24401f864cdcb
SHA512

2c06f8adbe1fed4bc1e9d3f285881da927b6cd90abb1198a63d5bf6c03f749d4877d5e66202497871e13f415d006b5a48708b9b11a6b2d646344b2b7dc7db796

Score

10^/10

raccoon 207ed4c493cfb59cd2f2f0a338be988518497063 evasion stealer trojan

Malware Config

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

207ed4c493cfb59cd2f2f0a338be988518497063

Attributes

url4cnc
http://91.219.236.27/marker2o1
http://94.158.245.167/marker2o1
http://185.163.204.216/marker2o1
http://185.225.19.238/marker2o1
http://185.163.204.218/marker2o1
https://t.me/marker2o1

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1476d6de5655cd75b02e84ab01a69d62220888e48bce181511a24401f864cdcb.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1476d6de5655cd75b02e84ab01a69d62220888e48bce181511a24401f864cdcb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1476d6de5655cd75b02e84ab01a69d62220888e48bce181511a24401f864cdcb.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

1476d6de5655cd75b02e84ab01a69d62220888e48bce181511a24401f864cdcb.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1476d6de5655cd75b02e84ab01a69d62220888e48bce181511a24401f864cdcb.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

1476d6de5655cd75b02e84ab01a69d62220888e48bce181511a24401f864cdcb.exe

pid	process
2680	1476d6de5655cd75b02e84ab01a69d62220888e48bce181511a24401f864cdcb.exe
2680	1476d6de5655cd75b02e84ab01a69d62220888e48bce181511a24401f864cdcb.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

1476d6de5655cd75b02e84ab01a69d62220888e48bce181511a24401f864cdcb.exe

pid	process
2680	1476d6de5655cd75b02e84ab01a69d62220888e48bce181511a24401f864cdcb.exe
2680	1476d6de5655cd75b02e84ab01a69d62220888e48bce181511a24401f864cdcb.exe
2680	1476d6de5655cd75b02e84ab01a69d62220888e48bce181511a24401f864cdcb.exe
2680	1476d6de5655cd75b02e84ab01a69d62220888e48bce181511a24401f864cdcb.exe

C:\Users\Admin\AppData\Local\Temp\1476d6de5655cd75b02e84ab01a69d62220888e48bce181511a24401f864cdcb.exe
"C:\Users\Admin\AppData\Local\Temp\1476d6de5655cd75b02e84ab01a69d62220888e48bce181511a24401f864cdcb.exe"
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2680

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2680-118-0x0000000000F50000-0x0000000001500000-memory.dmp

Filesize
5.7MB

Download
memory/2680-119-0x0000000000F50000-0x0000000001500000-memory.dmp

Filesize
5.7MB

Download
memory/2680-120-0x0000000000F50000-0x0000000001500000-memory.dmp

Filesize
5.7MB

Download
memory/2680-121-0x0000000003080000-0x00000000030C5000-memory.dmp

Filesize
276KB

Download
memory/2680-122-0x0000000000F50000-0x0000000001500000-memory.dmp

Filesize
5.7MB

Download
memory/2680-123-0x0000000000F50000-0x0000000001500000-memory.dmp

Filesize
5.7MB

Download
memory/2680-124-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/2680-126-0x0000000075C40000-0x0000000075E02000-memory.dmp

Filesize
1.8MB

Download
memory/2680-125-0x0000000000F50000-0x0000000001500000-memory.dmp

Filesize
5.7MB

Download
memory/2680-127-0x0000000000F50000-0x0000000001500000-memory.dmp

Filesize
5.7MB

Download
memory/2680-128-0x0000000076730000-0x0000000076821000-memory.dmp

Filesize
964KB

Download
memory/2680-129-0x0000000000F50000-0x0000000001500000-memory.dmp

Filesize
5.7MB

Download
memory/2680-130-0x0000000000F50000-0x0000000001500000-memory.dmp

Filesize
5.7MB

Download
memory/2680-131-0x0000000000F50000-0x0000000001500000-memory.dmp

Filesize
5.7MB

Download
memory/2680-132-0x0000000000F50000-0x0000000001500000-memory.dmp

Filesize
5.7MB

Download
memory/2680-133-0x0000000000F50000-0x0000000001500000-memory.dmp

Filesize
5.7MB

Download
memory/2680-134-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/2680-135-0x0000000000F50000-0x0000000001500000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads