Analysis
- max time kernel
151s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
14/07/2022, 05:00
General
- Target a81445c1b6d3cfac9357bc514c223651.exe
- Size 206KB
- Sample220714-fm24qaefek
- SHA256 42247d3cc7635107ddb52bab629358dfd32b4112b81ed083b30c4abd41d00628
Malware Config
Signatures
- Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 5 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a81445c1b6d3cfac9357bc514c223651.exe"C:\Users\Admin\AppData\Local\Temp\a81445c1b6d3cfac9357bc514c223651.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\9143.exeC:\Users\Admin\AppData\Local\Temp\9143.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Loads dropped DLL
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\222A.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\222A.dll2⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\99DC.exeC:\Users\Admin\AppData\Local\Temp\99DC.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
mozglue.dll
nss3.dll
sqlite3.dll
222A.dll
222A.dll
222A.dll
9143.exe
9143.exe
99DC.exe
99DC.exe
memory/960-159-0x00000000047D0000-0x0000000004888000-memory.dmp
memory/960-163-0x0000000004710000-0x00000000047CF000-memory.dmp
memory/960-161-0x00000000048A0000-0x0000000004944000-memory.dmp
memory/960-160-0x00000000048A0000-0x0000000004944000-memory.dmp
memory/960-146-0x00000000024B0000-0x0000000002747000-memory.dmp
memory/960-147-0x00000000044A0000-0x000000000464C000-memory.dmp
memory/960-148-0x0000000004710000-0x00000000047CF000-memory.dmp
memory/3636-130-0x00000000006C8000-0x00000000006D6000-memory.dmp
memory/3636-131-0x00000000007C0000-0x00000000007C9000-memory.dmp
memory/3636-132-0x0000000000400000-0x000000000064D000-memory.dmp
memory/3636-133-0x0000000000400000-0x000000000064D000-memory.dmp
memory/4640-138-0x0000000003622000-0x000000000376A000-memory.dmp
memory/4640-149-0x000000000C110000-0x000000000C1D4000-memory.dmp
memory/4640-150-0x000000000C110000-0x000000000C1D4000-memory.dmp
memory/4640-139-0x00000000030E6000-0x0000000003611000-memory.dmp
memory/4640-140-0x0000000003622000-0x000000000376A000-memory.dmp
memory/4640-137-0x00000000030E6000-0x0000000003611000-memory.dmp
memory/4640-157-0x0000000003622000-0x000000000376A000-memory.dmp
memory/5112-154-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5112-156-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5112-167-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5112-152-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5112-158-0x0000000000400000-0x0000000000411000-memory.dmp