raccoon | d6b47354dff2693d279b357d0901496908922679207ebef447e78160cd45bdf3

General

Target

7f98e524346266f8018ba22eaa6113d1.exe
Size

319KB
MD5

7f98e524346266f8018ba22eaa6113d1
SHA1

e778147c2e2c434ba997e96cd4d76dd4cb84ca42
SHA256

d6b47354dff2693d279b357d0901496908922679207ebef447e78160cd45bdf3
SHA512

1b1615a9753f8eafdafd9381265ef78e2e7bef3e1f26553ceb8d9c734a0cfbb83eb33ef488d927c53093dfd644ab8ce11203aa2aa69a0384cdafcedff9df4bcd

Score

10^/10

raccoon redline smokeloader f797145799b7b1b77b35d81de942eee0908da519 backdoor infostealer stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

f797145799b7b1b77b35d81de942eee0908da519

Attributes

url4cnc
http://91.219.236.27/capibar
http://94.158.245.167/capibar
http://185.163.204.216/capibar
http://185.225.19.238/capibar
http://185.163.204.218/capibar
https://t.me/capibar

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1224-80-0x0000000001020000-0x0000000001089000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file
Executes dropped EXE 4 IoCs

Processes:

8F64.exe8F64.exe935.exeC23.exe

pid process

608 8F64.exe
1156 8F64.exe
1272 935.exe
1224 C23.exe
Deletes itself 1 IoCs

Processes:

pid process

1412
Loads dropped DLL 1 IoCs

Processes:

8F64.exe

pid process

608 8F64.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

C23.exe

pid process

1224 C23.exe

pid	process
608	8F64.exe
1156	8F64.exe
1272	935.exe
1224	C23.exe

pid	process
1412

pid	process
608	8F64.exe

pid	process
1224	C23.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

7f98e524346266f8018ba22eaa6113d1.exe8F64.exe

description	pid	process	target process
PID 1472 set thread context of 768	1472	7f98e524346266f8018ba22eaa6113d1.exe	7f98e524346266f8018ba22eaa6113d1.exe
PID 608 set thread context of 1156	608	8F64.exe	8F64.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

7f98e524346266f8018ba22eaa6113d1.exe8F64.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7f98e524346266f8018ba22eaa6113d1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	8F64.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	8F64.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	8F64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7f98e524346266f8018ba22eaa6113d1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7f98e524346266f8018ba22eaa6113d1.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

7f98e524346266f8018ba22eaa6113d1.exe

pid	process
768	7f98e524346266f8018ba22eaa6113d1.exe
768	7f98e524346266f8018ba22eaa6113d1.exe
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412
1412

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1412
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

7f98e524346266f8018ba22eaa6113d1.exe8F64.exe

pid process

768 7f98e524346266f8018ba22eaa6113d1.exe
1156 8F64.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

1412
1412
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

pid process

1412
1412

pid	process
1412

pid	process
1412
1412

pid	process
1412
1412

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

7f98e524346266f8018ba22eaa6113d1.exe8F64.exe

description	pid	process	target process
PID 1472 wrote to memory of 768	1472	7f98e524346266f8018ba22eaa6113d1.exe	7f98e524346266f8018ba22eaa6113d1.exe
PID 1472 wrote to memory of 768	1472	7f98e524346266f8018ba22eaa6113d1.exe	7f98e524346266f8018ba22eaa6113d1.exe
PID 1472 wrote to memory of 768	1472	7f98e524346266f8018ba22eaa6113d1.exe	7f98e524346266f8018ba22eaa6113d1.exe
PID 1472 wrote to memory of 768	1472	7f98e524346266f8018ba22eaa6113d1.exe	7f98e524346266f8018ba22eaa6113d1.exe
PID 1472 wrote to memory of 768	1472	7f98e524346266f8018ba22eaa6113d1.exe	7f98e524346266f8018ba22eaa6113d1.exe
PID 1472 wrote to memory of 768	1472	7f98e524346266f8018ba22eaa6113d1.exe	7f98e524346266f8018ba22eaa6113d1.exe
PID 1472 wrote to memory of 768	1472	7f98e524346266f8018ba22eaa6113d1.exe	7f98e524346266f8018ba22eaa6113d1.exe
PID 1412 wrote to memory of 608	1412		8F64.exe
PID 1412 wrote to memory of 608	1412		8F64.exe
PID 1412 wrote to memory of 608	1412		8F64.exe
PID 1412 wrote to memory of 608	1412		8F64.exe
PID 608 wrote to memory of 1156	608	8F64.exe	8F64.exe
PID 608 wrote to memory of 1156	608	8F64.exe	8F64.exe
PID 608 wrote to memory of 1156	608	8F64.exe	8F64.exe
PID 608 wrote to memory of 1156	608	8F64.exe	8F64.exe
PID 608 wrote to memory of 1156	608	8F64.exe	8F64.exe
PID 608 wrote to memory of 1156	608	8F64.exe	8F64.exe
PID 608 wrote to memory of 1156	608	8F64.exe	8F64.exe
PID 1412 wrote to memory of 1272	1412		935.exe
PID 1412 wrote to memory of 1272	1412		935.exe
PID 1412 wrote to memory of 1272	1412		935.exe
PID 1412 wrote to memory of 1272	1412		935.exe
PID 1412 wrote to memory of 1224	1412		C23.exe
PID 1412 wrote to memory of 1224	1412		C23.exe
PID 1412 wrote to memory of 1224	1412		C23.exe
PID 1412 wrote to memory of 1224	1412		C23.exe
PID 1412 wrote to memory of 1224	1412		C23.exe
PID 1412 wrote to memory of 1224	1412		C23.exe
PID 1412 wrote to memory of 1224	1412		C23.exe

C:\Users\Admin\AppData\Local\Temp\7f98e524346266f8018ba22eaa6113d1.exe
"C:\Users\Admin\AppData\Local\Temp\7f98e524346266f8018ba22eaa6113d1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1472

C:\Users\Admin\AppData\Local\Temp\7f98e524346266f8018ba22eaa6113d1.exe
"C:\Users\Admin\AppData\Local\Temp\7f98e524346266f8018ba22eaa6113d1.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:768

C:\Users\Admin\AppData\Local\Temp\8F64.exe
C:\Users\Admin\AppData\Local\Temp\8F64.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:608

C:\Users\Admin\AppData\Local\Temp\8F64.exe
C:\Users\Admin\AppData\Local\Temp\8F64.exe
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1156

C:\Users\Admin\AppData\Local\Temp\935.exe
C:\Users\Admin\AppData\Local\Temp\935.exe
1⤵
- Executes dropped EXE
PID:1272

C:\Users\Admin\AppData\Local\Temp\C23.exe
C:\Users\Admin\AppData\Local\Temp\C23.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1224

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8F64.exe
MD5
830c02c39498ddbd7494ba8f0bc8fff2

SHA1
07dce439f86e555b436bd573c33a118ea6a893d0

SHA256
1fbcd71bd94633e2bfe36fdcb3af542562334fc61d52a5d2ecb9839e9e1a3e11

SHA512
ee82659d917d374f7f881b3c768f04a5f28251de2fa4bc98ae6c502c848be8775dd1ff33e492d3f002c32e30ffd8f91cd20be60c7f9ea18c21e0fc18093b7c20

Download Submit
C:\Users\Admin\AppData\Local\Temp\8F64.exe
MD5
830c02c39498ddbd7494ba8f0bc8fff2

SHA1
07dce439f86e555b436bd573c33a118ea6a893d0

SHA256
1fbcd71bd94633e2bfe36fdcb3af542562334fc61d52a5d2ecb9839e9e1a3e11

SHA512
ee82659d917d374f7f881b3c768f04a5f28251de2fa4bc98ae6c502c848be8775dd1ff33e492d3f002c32e30ffd8f91cd20be60c7f9ea18c21e0fc18093b7c20

Download Submit
C:\Users\Admin\AppData\Local\Temp\8F64.exe
MD5
830c02c39498ddbd7494ba8f0bc8fff2

SHA1
07dce439f86e555b436bd573c33a118ea6a893d0

SHA256
1fbcd71bd94633e2bfe36fdcb3af542562334fc61d52a5d2ecb9839e9e1a3e11

SHA512
ee82659d917d374f7f881b3c768f04a5f28251de2fa4bc98ae6c502c848be8775dd1ff33e492d3f002c32e30ffd8f91cd20be60c7f9ea18c21e0fc18093b7c20

Download Submit
C:\Users\Admin\AppData\Local\Temp\935.exe
MD5
bce50d5b17bb88f22f0000511026520d

SHA1
599aaed4ee72ec0e0fc4cada844a1c210e332961

SHA256
77e40ca1c6001b2c01ef50b84585d68127eeb5691c899b049a9948fb60b13455

SHA512
c7dea899ed181efd0474a8b181b8fd8e91c734703a03ac71381e072684c93dd6d002629ffcfeefb15b6ca79ba1cf8cc62acd2b16fe7e0faed444c6f3eebb7536

Download Submit
C:\Users\Admin\AppData\Local\Temp\C23.exe
MD5
0cefed061e2a2241ecd302d7790a2f80

SHA1
5f119195af2db118c5fbac21634bea00f5d5b8da

SHA256
014ad60fd2c294dd8fb63c022961e17df1ba74bb1209a64634112913edc44983

SHA512
7b7e4460dad4f176b11a66a37bbc1b2fd2c7e042c5e949c72edcc3c93d9bb9d210d8ecc95d8aad533c761947958e008c4ced8b5faef9319ebb5bf29752381cba

Download Submit
C:\Users\Admin\AppData\Local\Temp\C23.exe
MD5
0cefed061e2a2241ecd302d7790a2f80

SHA1
5f119195af2db118c5fbac21634bea00f5d5b8da

SHA256
014ad60fd2c294dd8fb63c022961e17df1ba74bb1209a64634112913edc44983

SHA512
7b7e4460dad4f176b11a66a37bbc1b2fd2c7e042c5e949c72edcc3c93d9bb9d210d8ecc95d8aad533c761947958e008c4ced8b5faef9319ebb5bf29752381cba

Download Submit
\Users\Admin\AppData\Local\Temp\8F64.exe
MD5
830c02c39498ddbd7494ba8f0bc8fff2

SHA1
07dce439f86e555b436bd573c33a118ea6a893d0

SHA256
1fbcd71bd94633e2bfe36fdcb3af542562334fc61d52a5d2ecb9839e9e1a3e11

SHA512
ee82659d917d374f7f881b3c768f04a5f28251de2fa4bc98ae6c502c848be8775dd1ff33e492d3f002c32e30ffd8f91cd20be60c7f9ea18c21e0fc18093b7c20

Download Submit
memory/608-61-0x0000000000000000-mapping.dmp

Download
memory/608-63-0x0000000000958000-0x0000000000969000-memory.dmp

Filesize
68KB

Download
memory/768-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/768-59-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/768-58-0x0000000000402F47-mapping.dmp

Download
memory/1156-67-0x0000000000402F47-mapping.dmp

Download
memory/1224-88-0x0000000001020000-0x0000000001021000-memory.dmp

Filesize
4KB

Download
memory/1224-91-0x0000000073D80000-0x0000000073E00000-memory.dmp

Filesize
512KB

Download
memory/1224-98-0x0000000002A00000-0x0000000002A01000-memory.dmp

Filesize
4KB

Download
memory/1224-73-0x0000000000000000-mapping.dmp

Download
memory/1224-97-0x0000000075030000-0x0000000075065000-memory.dmp

Filesize
212KB

Download
memory/1224-96-0x0000000074A70000-0x0000000074A87000-memory.dmp

Filesize
92KB

Download
memory/1224-95-0x0000000075C50000-0x000000007689A000-memory.dmp

Filesize
12.3MB

Download
memory/1224-77-0x0000000074B70000-0x0000000074BBA000-memory.dmp

Filesize
296KB

Download
memory/1224-80-0x0000000001020000-0x0000000001089000-memory.dmp

Filesize
420KB

Download
memory/1224-81-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1224-83-0x0000000076980000-0x0000000076A2C000-memory.dmp

Filesize
688KB

Download
memory/1224-84-0x0000000076F00000-0x0000000076F47000-memory.dmp

Filesize
284KB

Download
memory/1224-85-0x00000000753F0000-0x0000000075447000-memory.dmp

Filesize
348KB

Download
memory/1224-87-0x0000000076A30000-0x0000000076B8C000-memory.dmp

Filesize
1.4MB

Download
memory/1224-92-0x0000000000120000-0x0000000000165000-memory.dmp

Filesize
276KB

Download
memory/1224-90-0x0000000076F50000-0x0000000076FDF000-memory.dmp

Filesize
572KB

Download
memory/1272-71-0x0000000000000000-mapping.dmp

Download
memory/1272-93-0x0000000001BC0000-0x0000000001C4F000-memory.dmp

Filesize
572KB

Download
memory/1272-94-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1272-78-0x000000000026B000-0x00000000002BA000-memory.dmp

Filesize
316KB

Download
memory/1412-60-0x00000000025C0000-0x00000000025D6000-memory.dmp

Filesize
88KB

Download
memory/1412-70-0x0000000002AD0000-0x0000000002AE6000-memory.dmp

Filesize
88KB

Download
memory/1472-55-0x0000000000698000-0x00000000006A9000-memory.dmp

Filesize
68KB

Download
memory/1472-56-0x0000000000020000-0x0000000000029000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads