Analysis
- max time kernel
153s - max time network
165s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
14/07/2022, 06:59
General
- Target 7ad4d15bc1714f693138b87113e55ccd.exe
- Size 246KB
- Sample220714-hr4t8aecd6
- SHA256 23c72e85c5f0e6d3843568913c7c1990e7ff818e23340663b60f078650f6d8bb
Malware Config
Signatures
- Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ad4d15bc1714f693138b87113e55ccd.exe"C:\Users\Admin\AppData\Local\Temp\7ad4d15bc1714f693138b87113e55ccd.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\B565.exeC:\Users\Admin\AppData\Local\Temp\B565.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\4A.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\4A.dll2⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\C793.exeC:\Users\Admin\AppData\Local\Temp\C793.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Local\Temp\D30D.exeC:\Users\Admin\AppData\Local\Temp\D30D.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
4A.dll
4A.dll
4A.dll
B565.exe
B565.exe
C793.exe
C793.exe
D30D.exe
D30D.exe
memory/1120-163-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1120-162-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1120-160-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1120-158-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1344-150-0x0000000004650000-0x0000000004708000-memory.dmp
memory/1344-151-0x0000000004720000-0x00000000047C4000-memory.dmp
memory/1344-147-0x00000000022C0000-0x0000000002557000-memory.dmp
memory/1344-148-0x0000000004310000-0x00000000044BC000-memory.dmp
memory/1344-149-0x0000000004580000-0x000000000463F000-memory.dmp
memory/1344-155-0x0000000004580000-0x000000000463F000-memory.dmp
memory/1344-152-0x0000000004720000-0x00000000047C4000-memory.dmp
memory/2660-171-0x0000000000400000-0x0000000000A1C000-memory.dmp
memory/2660-170-0x0000000000AB0000-0x0000000000AB9000-memory.dmp
memory/2660-169-0x0000000000ADD000-0x0000000000AED000-memory.dmp
memory/3284-164-0x00000000029D0000-0x00000000029D6000-memory.dmp
memory/3284-156-0x000000000E740000-0x000000000E804000-memory.dmp
memory/3284-154-0x000000000E740000-0x000000000E804000-memory.dmp
memory/3284-165-0x0000000002F0F000-0x0000000003057000-memory.dmp
memory/3284-139-0x0000000002F0F000-0x0000000003057000-memory.dmp
memory/3284-138-0x00000000029D3000-0x0000000002EFE000-memory.dmp
memory/3284-141-0x00000000029D3000-0x0000000002EFE000-memory.dmp
memory/3284-142-0x0000000002F0F000-0x0000000003057000-memory.dmp
memory/4564-133-0x00000000008BD000-0x00000000008C6000-memory.dmp
memory/4564-134-0x0000000000400000-0x0000000000659000-memory.dmp
memory/4564-130-0x00000000008BD000-0x00000000008C6000-memory.dmp
memory/4564-132-0x0000000000400000-0x0000000000659000-memory.dmp
memory/4564-131-0x0000000002250000-0x0000000002259000-memory.dmp