Analysis

  • max time kernel
    167s
  • max time network
    171s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    19-04-2022 02:51

General

  • Target

    116174e4a008581dd7d50dcddaf8d9f110c9be6861015d48d6a672e71ecaee8a.exe

  • Size

    5.5MB

  • MD5

    454d5e18e6611f5176234a877c7217fe

  • SHA1

    ab8561630f86501cbf8241d8ab2a6a0cb019f8ba

  • SHA256

    116174e4a008581dd7d50dcddaf8d9f110c9be6861015d48d6a672e71ecaee8a

  • SHA512

    3199487e95110612612f9fbc68d1ff7d3ded4c09f72c4999905cf4d84c0c966fecf74798a91971f2496c5143c150fefe4070d826541a834c4e8a3c57d7e9f475

Malware Config

Extracted

Family

raccoon

Version

1.7.1-hotfix

Botnet

0422feff6c251ddfdca83125d9b8ae570db3b316

Attributes
  • url4cnc

    https://telete.in/jbitchsucks

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Raccoon Stealer Payload 4 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 2 IoCs
  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\116174e4a008581dd7d50dcddaf8d9f110c9be6861015d48d6a672e71ecaee8a.exe
    "C:\Users\Admin\AppData\Local\Temp\116174e4a008581dd7d50dcddaf8d9f110c9be6861015d48d6a672e71ecaee8a.exe"
    1⤵
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1788
    • C:\Users\Admin\AppData\Local\Temp\116174e4a008581dd7d50dcddaf8d9f110c9be6861015d48d6a672e71ecaee8a.exe
      "C:\Users\Admin\AppData\Local\Temp\116174e4a008581dd7d50dcddaf8d9f110c9be6861015d48d6a672e71ecaee8a.exe"
      2⤵
        PID:4400

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Virtualization/Sandbox Evasion

    1
    T1497

    Discovery

    Query Registry

    2
    T1012

    Virtualization/Sandbox Evasion

    1
    T1497

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\5fe04141-d3b5-4927-8ee5-5a463e534407\njn.dll
      Filesize

      94KB

      MD5

      14ff402962ad21b78ae0b4c43cd1f194

      SHA1

      f8a510eb26666e875a5bdd1cadad40602763ad72

      SHA256

      fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

      SHA512

      daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

    • C:\Users\Admin\AppData\Local\Temp\b35bc50e-fc56-4239-a7d0-bb79118b31c9\AgileDotNetRT.dll
      Filesize

      94KB

      MD5

      14ff402962ad21b78ae0b4c43cd1f194

      SHA1

      f8a510eb26666e875a5bdd1cadad40602763ad72

      SHA256

      fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

      SHA512

      daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

    • memory/1788-132-0x0000000000660000-0x0000000000C12000-memory.dmp
      Filesize

      5.7MB

    • memory/1788-133-0x0000000000660000-0x0000000000C12000-memory.dmp
      Filesize

      5.7MB

    • memory/1788-135-0x0000000073540000-0x00000000735C9000-memory.dmp
      Filesize

      548KB

    • memory/1788-136-0x0000000006460000-0x0000000006A04000-memory.dmp
      Filesize

      5.6MB

    • memory/1788-137-0x0000000005F90000-0x0000000006022000-memory.dmp
      Filesize

      584KB

    • memory/4400-139-0x0000000000000000-mapping.dmp
    • memory/4400-140-0x0000000000400000-0x0000000000492000-memory.dmp
      Filesize

      584KB

    • memory/4400-141-0x0000000000400000-0x0000000000492000-memory.dmp
      Filesize

      584KB

    • memory/4400-142-0x0000000000400000-0x0000000000492000-memory.dmp
      Filesize

      584KB

    • memory/4400-143-0x0000000000400000-0x0000000000492000-memory.dmp
      Filesize

      584KB