Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    27-09-2022 04:32

General

  • Target

    lrPBx4qjVQLL.exe

  • Size

    1.5MB

  • MD5

    018dbebc18d0989b6c5a0916a7aeb8ee

  • SHA1

    3d9d22ef47c09230fda8d66945e00e3538f2d975

  • SHA256

    82112a8c76d6bab37acadc1e1a113e43b6dc966f48b9f2a0cc8fdbd844ee2f7a

  • SHA512

    a97b649deaed7f44b03f882648dbaa26ebddc9d925e161d6b523a09861950efef17cb14339f22a92184ca9184abb92b04e2d4f07a7914ae0e091f4f2560adf96

  • SSDEEP

    49152:8N0TnIUbWriymtRAZbUJylRyOuo+ecZTa1gBHXOlr/pQVpu7S/cY:gKnIUbWrJUJy/yOuo/cZTa1cXO/DS/b

Malware Config

Extracted

Family

raccoon

Botnet

9b19cf60d9bdf65b8a2495aa965456c3

C2

http://94.131.107.206

rc4.plain

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\lrPBx4qjVQLL.exe
    "C:\Users\Admin\AppData\Local\Temp\lrPBx4qjVQLL.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1200
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1640
      • C:\Users\Admin\AppData\Roaming\S7PlPxzm.exe
        "C:\Users\Admin\AppData\Roaming\S7PlPxzm.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1092
      • C:\Users\Admin\AppData\Roaming\8Mzq7oAo.exe
        "C:\Users\Admin\AppData\Roaming\8Mzq7oAo.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:992
        • C:\Users\Admin\AppData\Roaming\8Mzq7oAo.exe
          "C:\Users\Admin\AppData\Roaming\8Mzq7oAo.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1668
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
            5⤵
            • Creates scheduled task(s)
            PID:1748

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\8Mzq7oAo.exe
    Filesize

    519KB

    MD5

    0cc25540c7ea712231dfaa165733b316

    SHA1

    2c4398ac4c7e4ea2605a7f9cd96b8c15db743e35

    SHA256

    166af3429b6d9a81fbb537849190190516596c0c4a44be03728a408003039d82

    SHA512

    34d25b55546e242e5940ee7c891fb37b2ad257a06b91d87e56e47385495ec45386accfb91d405cedd673b4507ede392b3533b1a218a94e90adcfcf432c697eb4

  • C:\Users\Admin\AppData\Roaming\8Mzq7oAo.exe
    Filesize

    519KB

    MD5

    0cc25540c7ea712231dfaa165733b316

    SHA1

    2c4398ac4c7e4ea2605a7f9cd96b8c15db743e35

    SHA256

    166af3429b6d9a81fbb537849190190516596c0c4a44be03728a408003039d82

    SHA512

    34d25b55546e242e5940ee7c891fb37b2ad257a06b91d87e56e47385495ec45386accfb91d405cedd673b4507ede392b3533b1a218a94e90adcfcf432c697eb4

  • C:\Users\Admin\AppData\Roaming\8Mzq7oAo.exe
    Filesize

    519KB

    MD5

    0cc25540c7ea712231dfaa165733b316

    SHA1

    2c4398ac4c7e4ea2605a7f9cd96b8c15db743e35

    SHA256

    166af3429b6d9a81fbb537849190190516596c0c4a44be03728a408003039d82

    SHA512

    34d25b55546e242e5940ee7c891fb37b2ad257a06b91d87e56e47385495ec45386accfb91d405cedd673b4507ede392b3533b1a218a94e90adcfcf432c697eb4

  • C:\Users\Admin\AppData\Roaming\S7PlPxzm.exe
    Filesize

    1.9MB

    MD5

    5986aff76e7813045b1b130efbb10d30

    SHA1

    62b1f733fe7ed0c0230c20dae3c4a65ecb28e180

    SHA256

    7dd44d3b3df4f14474d20ffa23e2fb20dcf22ed3a1458b345a1bd85563ac4a62

    SHA512

    bfa2cad2bbbb61af7dbd22818db048ddaf68e2e22d1c55d80450a7a0c4c31c09bf596f04ebc2a7f55ac70c294ae01d3e8987af4d0bbb60c63662d21c008b3115

  • \Users\Admin\AppData\LocalLow\mozglue.dll
    Filesize

    612KB

    MD5

    f07d9977430e762b563eaadc2b94bbfa

    SHA1

    da0a05b2b8d269fb73558dfcf0ed5c167f6d3877

    SHA256

    4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862

    SHA512

    6afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf

  • \Users\Admin\AppData\LocalLow\nss3.dll
    Filesize

    1.9MB

    MD5

    f67d08e8c02574cbc2f1122c53bfb976

    SHA1

    6522992957e7e4d074947cad63189f308a80fcf2

    SHA256

    c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e

    SHA512

    2e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5

  • \Users\Admin\AppData\LocalLow\sqlite3.dll
    Filesize

    1.0MB

    MD5

    dbf4f8dcefb8056dc6bae4b67ff810ce

    SHA1

    bbac1dd8a07c6069415c04b62747d794736d0689

    SHA256

    47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68

    SHA512

    b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1

  • \Users\Admin\AppData\Roaming\8Mzq7oAo.exe
    Filesize

    519KB

    MD5

    0cc25540c7ea712231dfaa165733b316

    SHA1

    2c4398ac4c7e4ea2605a7f9cd96b8c15db743e35

    SHA256

    166af3429b6d9a81fbb537849190190516596c0c4a44be03728a408003039d82

    SHA512

    34d25b55546e242e5940ee7c891fb37b2ad257a06b91d87e56e47385495ec45386accfb91d405cedd673b4507ede392b3533b1a218a94e90adcfcf432c697eb4

  • \Users\Admin\AppData\Roaming\S7PlPxzm.exe
    Filesize

    1.9MB

    MD5

    5986aff76e7813045b1b130efbb10d30

    SHA1

    62b1f733fe7ed0c0230c20dae3c4a65ecb28e180

    SHA256

    7dd44d3b3df4f14474d20ffa23e2fb20dcf22ed3a1458b345a1bd85563ac4a62

    SHA512

    bfa2cad2bbbb61af7dbd22818db048ddaf68e2e22d1c55d80450a7a0c4c31c09bf596f04ebc2a7f55ac70c294ae01d3e8987af4d0bbb60c63662d21c008b3115

  • memory/992-82-0x0000000000EF0000-0x0000000000F74000-memory.dmp
    Filesize

    528KB

  • memory/992-88-0x0000000000850000-0x0000000000868000-memory.dmp
    Filesize

    96KB

  • memory/992-84-0x0000000000650000-0x0000000000684000-memory.dmp
    Filesize

    208KB

  • memory/992-89-0x0000000000B70000-0x0000000000B8A000-memory.dmp
    Filesize

    104KB

  • memory/992-78-0x0000000000000000-mapping.dmp
  • memory/992-90-0x0000000000EC0000-0x0000000000EC6000-memory.dmp
    Filesize

    24KB

  • memory/1092-101-0x0000000002810000-0x000000000298F000-memory.dmp
    Filesize

    1.5MB

  • memory/1092-100-0x0000000002080000-0x0000000002810000-memory.dmp
    Filesize

    7.6MB

  • memory/1092-86-0x0000000002810000-0x000000000298F000-memory.dmp
    Filesize

    1.5MB

  • memory/1092-85-0x0000000002810000-0x000000000298F000-memory.dmp
    Filesize

    1.5MB

  • memory/1092-81-0x0000000002080000-0x0000000002810000-memory.dmp
    Filesize

    7.6MB

  • memory/1092-74-0x0000000000000000-mapping.dmp
  • memory/1092-76-0x0000000002080000-0x0000000002810000-memory.dmp
    Filesize

    7.6MB

  • memory/1200-60-0x0000000001F20000-0x0000000002064000-memory.dmp
    Filesize

    1.3MB

  • memory/1200-55-0x00000000020B0000-0x000000000271A000-memory.dmp
    Filesize

    6.4MB

  • memory/1200-56-0x0000000001F20000-0x0000000002064000-memory.dmp
    Filesize

    1.3MB

  • memory/1200-57-0x0000000075AC1000-0x0000000075AC3000-memory.dmp
    Filesize

    8KB

  • memory/1200-58-0x0000000001F20000-0x0000000002064000-memory.dmp
    Filesize

    1.3MB

  • memory/1200-59-0x00000000020B0000-0x000000000271A000-memory.dmp
    Filesize

    6.4MB

  • memory/1200-61-0x000000000BA70000-0x000000000BB36000-memory.dmp
    Filesize

    792KB

  • memory/1200-54-0x00000000020B0000-0x000000000271A000-memory.dmp
    Filesize

    6.4MB

  • memory/1200-66-0x0000000001F20000-0x0000000002064000-memory.dmp
    Filesize

    1.3MB

  • memory/1640-67-0x0000000000400000-0x0000000000414000-memory.dmp
    Filesize

    80KB

  • memory/1640-69-0x0000000000400000-0x0000000000414000-memory.dmp
    Filesize

    80KB

  • memory/1640-62-0x0000000000400000-0x0000000000414000-memory.dmp
    Filesize

    80KB

  • memory/1640-64-0x0000000000400000-0x0000000000414000-memory.dmp
    Filesize

    80KB

  • memory/1668-96-0x0000000000400000-0x0000000000423000-memory.dmp
    Filesize

    140KB

  • memory/1668-97-0x0000000000400000-0x0000000000423000-memory.dmp
    Filesize

    140KB

  • memory/1668-98-0x0000000000400000-0x0000000000423000-memory.dmp
    Filesize

    140KB

  • memory/1668-91-0x0000000000400000-0x0000000000423000-memory.dmp
    Filesize

    140KB

  • memory/1668-94-0x0000000000400000-0x0000000000423000-memory.dmp
    Filesize

    140KB

  • memory/1668-102-0x0000000000400000-0x0000000000423000-memory.dmp
    Filesize

    140KB

  • memory/1668-103-0x0000000000402DAA-mapping.dmp
  • memory/1668-92-0x0000000000400000-0x0000000000423000-memory.dmp
    Filesize

    140KB

  • memory/1668-107-0x0000000000400000-0x0000000000423000-memory.dmp
    Filesize

    140KB

  • memory/1668-109-0x0000000000400000-0x0000000000423000-memory.dmp
    Filesize

    140KB

  • memory/1748-108-0x0000000000000000-mapping.dmp