raccoon | 4cce0df1d375da9741814d70f117deee67d1beab317fb746d3ebefdcb8dff90c

General

Target

82a730933d3fe64cc9c17cd1144e99ce.exe
Size

11.7MB
MD5

82a730933d3fe64cc9c17cd1144e99ce
SHA1

bb87afc579bbeb0cf820b99b5ce3af84dd8f646a
SHA256

4cce0df1d375da9741814d70f117deee67d1beab317fb746d3ebefdcb8dff90c
SHA512

c8107b24896a95b03496e03fc631aa12d9ca02b911a5bad6439cf5bc61372b3120b6dab3c5d81607f2ac165408ae9f208a0b0ece8beb0dfc218897d201ec1005

Score

10^/10

raccoon 517bb0d640c1242c3f069aab3d1018d6 discovery spyware stealer

Malware Config

Extracted

Family

raccoon

Botnet

517bb0d640c1242c3f069aab3d1018d6

C2

http://51.195.166.178/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/844-141-0x0000000000DB0000-0x0000000001872000-memory.dmp	family_raccoon
behavioral2/memory/844-143-0x0000000000DB0000-0x0000000001872000-memory.dmp	family_raccoon
behavioral2/memory/844-147-0x0000000000DB0000-0x0000000001872000-memory.dmp	family_raccoon
behavioral2/memory/844-152-0x0000000000DB0000-0x0000000001872000-memory.dmp	family_raccoon

Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

wbdgnfhmtdrhjh.c.exeTopaz.Gigapixel.AI.6.2.0.exeTopaz.Gigapixel.AI.6.2.0.tmp

pid process

844 wbdgnfhmtdrhjh.c.exe
3832 Topaz.Gigapixel.AI.6.2.0.exe
2312 Topaz.Gigapixel.AI.6.2.0.tmp

pid	process
844	wbdgnfhmtdrhjh.c.exe
3832	Topaz.Gigapixel.AI.6.2.0.exe
2312	Topaz.Gigapixel.AI.6.2.0.tmp

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

82a730933d3fe64cc9c17cd1144e99ce.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation	82a730933d3fe64cc9c17cd1144e99ce.exe

Loads dropped DLL 3 IoCs

Processes:

wbdgnfhmtdrhjh.c.exe

pid process

844 wbdgnfhmtdrhjh.c.exe
844 wbdgnfhmtdrhjh.c.exe
844 wbdgnfhmtdrhjh.c.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

wbdgnfhmtdrhjh.c.exe

pid process

844 wbdgnfhmtdrhjh.c.exe
844 wbdgnfhmtdrhjh.c.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

wbdgnfhmtdrhjh.c.exe

pid process

844 wbdgnfhmtdrhjh.c.exe
844 wbdgnfhmtdrhjh.c.exe

pid	process
844	wbdgnfhmtdrhjh.c.exe
844	wbdgnfhmtdrhjh.c.exe
844	wbdgnfhmtdrhjh.c.exe

pid	process
844	wbdgnfhmtdrhjh.c.exe
844	wbdgnfhmtdrhjh.c.exe

pid	process
844	wbdgnfhmtdrhjh.c.exe
844	wbdgnfhmtdrhjh.c.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

82a730933d3fe64cc9c17cd1144e99ce.exeTopaz.Gigapixel.AI.6.2.0.exe

description	pid	process	target process
PID 4680 wrote to memory of 844	4680	82a730933d3fe64cc9c17cd1144e99ce.exe	wbdgnfhmtdrhjh.c.exe
PID 4680 wrote to memory of 844	4680	82a730933d3fe64cc9c17cd1144e99ce.exe	wbdgnfhmtdrhjh.c.exe
PID 4680 wrote to memory of 844	4680	82a730933d3fe64cc9c17cd1144e99ce.exe	wbdgnfhmtdrhjh.c.exe
PID 4680 wrote to memory of 3832	4680	82a730933d3fe64cc9c17cd1144e99ce.exe	Topaz.Gigapixel.AI.6.2.0.exe
PID 4680 wrote to memory of 3832	4680	82a730933d3fe64cc9c17cd1144e99ce.exe	Topaz.Gigapixel.AI.6.2.0.exe
PID 4680 wrote to memory of 3832	4680	82a730933d3fe64cc9c17cd1144e99ce.exe	Topaz.Gigapixel.AI.6.2.0.exe
PID 3832 wrote to memory of 2312	3832	Topaz.Gigapixel.AI.6.2.0.exe	Topaz.Gigapixel.AI.6.2.0.tmp
PID 3832 wrote to memory of 2312	3832	Topaz.Gigapixel.AI.6.2.0.exe	Topaz.Gigapixel.AI.6.2.0.tmp
PID 3832 wrote to memory of 2312	3832	Topaz.Gigapixel.AI.6.2.0.exe	Topaz.Gigapixel.AI.6.2.0.tmp

C:\Users\Admin\AppData\Local\Temp\82a730933d3fe64cc9c17cd1144e99ce.exe
"C:\Users\Admin\AppData\Local\Temp\82a730933d3fe64cc9c17cd1144e99ce.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4680

C:\Users\Admin\AppData\Local\Temp\wbdgnfhmtdrhjh.c.exe
"C:\Users\Admin\AppData\Local\Temp\wbdgnfhmtdrhjh.c.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:844

C:\Users\Admin\AppData\Local\Temp\Topaz.Gigapixel.AI.6.2.0.exe
"C:\Users\Admin\AppData\Local\Temp\Topaz.Gigapixel.AI.6.2.0.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832

C:\Users\Admin\AppData\Local\Temp\is-VRMQU.tmp\Topaz.Gigapixel.AI.6.2.0.tmp
"C:\Users\Admin\AppData\Local\Temp\is-VRMQU.tmp\Topaz.Gigapixel.AI.6.2.0.tmp" /SL5="$80042,356352,0,C:\Users\Admin\AppData\Local\Temp\Topaz.Gigapixel.AI.6.2.0.exe"
3⤵
- Executes dropped EXE
PID:2312

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\mozglue.dll
Filesize
612KB

MD5
f07d9977430e762b563eaadc2b94bbfa

SHA1
da0a05b2b8d269fb73558dfcf0ed5c167f6d3877

SHA256
4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862

SHA512
6afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf

Download Submit
C:\Users\Admin\AppData\LocalLow\nss3.dll
Filesize
1.9MB

MD5
f67d08e8c02574cbc2f1122c53bfb976

SHA1
6522992957e7e4d074947cad63189f308a80fcf2

SHA256
c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e

SHA512
2e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5

Download Submit
C:\Users\Admin\AppData\LocalLow\sqlite3.dll
Filesize
1.0MB

MD5
dbf4f8dcefb8056dc6bae4b67ff810ce

SHA1
bbac1dd8a07c6069415c04b62747d794736d0689

SHA256
47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68

SHA512
b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Topaz.Gigapixel.AI.6.2.0.exe
Filesize
880KB

MD5
0157ddacf893999fba2b7dbb75d16139

SHA1
d3475592157d226b9678834975d1ceda35a2d931

SHA256
2f9dc55f35691a05ea6228882d5451967abd0f5ae300bb5c8a7cd8436c110aaa

SHA512
afacd57e387c7224b9621b09129e86d783fc6ccba4499ca52ab72f7129ae7500503f183e2529d61ebbc951c166ee6cef99bad28ef9f2d01b644544cc5fe429df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Topaz.Gigapixel.AI.6.2.0.exe
Filesize
880KB

MD5
0157ddacf893999fba2b7dbb75d16139

SHA1
d3475592157d226b9678834975d1ceda35a2d931

SHA256
2f9dc55f35691a05ea6228882d5451967abd0f5ae300bb5c8a7cd8436c110aaa

SHA512
afacd57e387c7224b9621b09129e86d783fc6ccba4499ca52ab72f7129ae7500503f183e2529d61ebbc951c166ee6cef99bad28ef9f2d01b644544cc5fe429df

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VRMQU.tmp\Topaz.Gigapixel.AI.6.2.0.tmp
Filesize
1.2MB

MD5
bbef6816c79b28c22b5b711d2b1ca63a

SHA1
974ba168ddbd29dcb1aabe1be07d386f36cfa582

SHA256
117f7abfa7797616f740722cc1d7288ed2638ab1eb72c00847644cca575c69d4

SHA512
8db56b03594eb82931f643def440d0364a7dc22ac9ed26b96531bd2466193ad99a6a6d633cec29f96aeb8f6261feed0d30dd2c6256e968c146fe1981e76d7c47

Download Submit
C:\Users\Admin\AppData\Local\Temp\wbdgnfhmtdrhjh.c.exe
Filesize
6.9MB

MD5
dda96ab1ac0c5978fa7c06bfd68341e5

SHA1
90ac02b4941eaeaad8cc5be2cd7e445ded96fa98

SHA256
7f8e03d60926d0cd52816dc81e833d63b70f21108c2e551780efa5ed9405be46

SHA512
f9adb6118131f4ebd0f7c386aecde0316b46fe710fbb76f9815adf324a9e016df1f0784be85bfc201f8e6ffcf9162cda6ee8f32139c55ef4e0aa7f2dd3e294f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\wbdgnfhmtdrhjh.c.exe
Filesize
6.9MB

MD5
dda96ab1ac0c5978fa7c06bfd68341e5

SHA1
90ac02b4941eaeaad8cc5be2cd7e445ded96fa98

SHA256
7f8e03d60926d0cd52816dc81e833d63b70f21108c2e551780efa5ed9405be46

SHA512
f9adb6118131f4ebd0f7c386aecde0316b46fe710fbb76f9815adf324a9e016df1f0784be85bfc201f8e6ffcf9162cda6ee8f32139c55ef4e0aa7f2dd3e294f2

Download Submit
memory/844-147-0x0000000000DB0000-0x0000000001872000-memory.dmp

Filesize
10.8MB

Download
memory/844-141-0x0000000000DB0000-0x0000000001872000-memory.dmp

Filesize
10.8MB

Download
memory/844-143-0x0000000000DB0000-0x0000000001872000-memory.dmp

Filesize
10.8MB

Download
memory/844-132-0x0000000000000000-mapping.dmp

Download
memory/844-152-0x0000000000DB0000-0x0000000001872000-memory.dmp

Filesize
10.8MB

Download
memory/2312-145-0x0000000000000000-mapping.dmp

Download
memory/3832-138-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/3832-142-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/3832-148-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/3832-135-0x0000000000000000-mapping.dmp

Download
memory/4680-137-0x00007FFD261C0000-0x00007FFD26C81000-memory.dmp

Filesize
10.8MB

Download
memory/4680-130-0x00000000009B0000-0x0000000001562000-memory.dmp

Filesize
11.7MB

Download
memory/4680-131-0x00007FFD261C0000-0x00007FFD26C81000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads