Analysis

  • max time kernel
    142s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-09-2022 04:32

General

  • Target

    lrPBx4qjVQLL.exe

  • Size

    1.5MB

  • MD5

    018dbebc18d0989b6c5a0916a7aeb8ee

  • SHA1

    3d9d22ef47c09230fda8d66945e00e3538f2d975

  • SHA256

    82112a8c76d6bab37acadc1e1a113e43b6dc966f48b9f2a0cc8fdbd844ee2f7a

  • SHA512

    a97b649deaed7f44b03f882648dbaa26ebddc9d925e161d6b523a09861950efef17cb14339f22a92184ca9184abb92b04e2d4f07a7914ae0e091f4f2560adf96

  • SSDEEP

    49152:8N0TnIUbWriymtRAZbUJylRyOuo+ecZTa1gBHXOlr/pQVpu7S/cY:gKnIUbWrJUJy/yOuo/cZTa1cXO/DS/b

Malware Config

Extracted

Family

raccoon

Botnet

9b19cf60d9bdf65b8a2495aa965456c3

C2

http://94.131.107.206

rc4.plain

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 5 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\lrPBx4qjVQLL.exe
    "C:\Users\Admin\AppData\Local\Temp\lrPBx4qjVQLL.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:892
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:460
      • C:\Users\Admin\AppData\Roaming\0SjSYePw.exe
        "C:\Users\Admin\AppData\Roaming\0SjSYePw.exe"
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4040
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\TypeRes\DllResource.exe"
          4⤵
          • Creates scheduled task(s)
          PID:820
        • C:\Users\Admin\TypeRes\DllResource.exe
          "C:\Users\Admin\TypeRes\DllResource.exe"
          4⤵
          • Executes dropped EXE
          PID:3976
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Roaming\0SjSYePw.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1324
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            5⤵
              PID:4560
            • C:\Windows\SysWOW64\PING.EXE
              ping 127.0.0.1
              5⤵
              • Runs ping.exe
              PID:4208
        • C:\Users\Admin\AppData\Roaming\8vl94O51.exe
          "C:\Users\Admin\AppData\Roaming\8vl94O51.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1684
          • C:\Users\Admin\AppData\Roaming\8vl94O51.exe
            "C:\Users\Admin\AppData\Roaming\8vl94O51.exe"
            4⤵
            • Executes dropped EXE
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:228
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
              5⤵
              • Creates scheduled task(s)
              PID:4300
        • C:\Users\Admin\AppData\Local\Temp\Q7j7XBa6.exe
          "C:\Users\Admin\AppData\Local\Temp\Q7j7XBa6.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Executes dropped EXE
          • Checks BIOS information in registry
          • Checks whether UAC is enabled
          PID:3244

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Virtualization/Sandbox Evasion

    1
    T1497

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    3
    T1012

    Virtualization/Sandbox Evasion

    1
    T1497

    System Information Discovery

    4
    T1082

    Remote System Discovery

    1
    T1018

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\mozglue.dll
      Filesize

      612KB

      MD5

      f07d9977430e762b563eaadc2b94bbfa

      SHA1

      da0a05b2b8d269fb73558dfcf0ed5c167f6d3877

      SHA256

      4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862

      SHA512

      6afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf

    • C:\Users\Admin\AppData\LocalLow\nss3.dll
      Filesize

      1.9MB

      MD5

      f67d08e8c02574cbc2f1122c53bfb976

      SHA1

      6522992957e7e4d074947cad63189f308a80fcf2

      SHA256

      c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e

      SHA512

      2e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5

    • C:\Users\Admin\AppData\LocalLow\sqlite3.dll
      Filesize

      1.0MB

      MD5

      dbf4f8dcefb8056dc6bae4b67ff810ce

      SHA1

      bbac1dd8a07c6069415c04b62747d794736d0689

      SHA256

      47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68

      SHA512

      b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1

    • C:\Users\Admin\AppData\Local\Temp\Q7j7XBa6.exe
      Filesize

      16.6MB

      MD5

      4d12325765be0951b3d05237dd68b3f8

      SHA1

      6e3280fa3953ac2b42c9f2002b0a8188c2742f25

      SHA256

      a8ef7985e7e029c6f66dd8571568d053c1a65b5d493553bb20fae8846a7ae2e4

      SHA512

      d0351cc8e8875a95473cabf40e58fc1fb7ffb94ddf124fafb400e0b7dda1377a9996a7d516026b437de9e4acff869ae29252949a71dee324727c073ed651b2f1

    • C:\Users\Admin\AppData\Local\Temp\Q7j7XBa6.exe
      Filesize

      16.6MB

      MD5

      4d12325765be0951b3d05237dd68b3f8

      SHA1

      6e3280fa3953ac2b42c9f2002b0a8188c2742f25

      SHA256

      a8ef7985e7e029c6f66dd8571568d053c1a65b5d493553bb20fae8846a7ae2e4

      SHA512

      d0351cc8e8875a95473cabf40e58fc1fb7ffb94ddf124fafb400e0b7dda1377a9996a7d516026b437de9e4acff869ae29252949a71dee324727c073ed651b2f1

    • C:\Users\Admin\AppData\Roaming\0SjSYePw.exe
      Filesize

      1.9MB

      MD5

      5986aff76e7813045b1b130efbb10d30

      SHA1

      62b1f733fe7ed0c0230c20dae3c4a65ecb28e180

      SHA256

      7dd44d3b3df4f14474d20ffa23e2fb20dcf22ed3a1458b345a1bd85563ac4a62

      SHA512

      bfa2cad2bbbb61af7dbd22818db048ddaf68e2e22d1c55d80450a7a0c4c31c09bf596f04ebc2a7f55ac70c294ae01d3e8987af4d0bbb60c63662d21c008b3115

    • C:\Users\Admin\AppData\Roaming\0SjSYePw.exe
      Filesize

      1.9MB

      MD5

      5986aff76e7813045b1b130efbb10d30

      SHA1

      62b1f733fe7ed0c0230c20dae3c4a65ecb28e180

      SHA256

      7dd44d3b3df4f14474d20ffa23e2fb20dcf22ed3a1458b345a1bd85563ac4a62

      SHA512

      bfa2cad2bbbb61af7dbd22818db048ddaf68e2e22d1c55d80450a7a0c4c31c09bf596f04ebc2a7f55ac70c294ae01d3e8987af4d0bbb60c63662d21c008b3115

    • C:\Users\Admin\AppData\Roaming\8vl94O51.exe
      Filesize

      519KB

      MD5

      0cc25540c7ea712231dfaa165733b316

      SHA1

      2c4398ac4c7e4ea2605a7f9cd96b8c15db743e35

      SHA256

      166af3429b6d9a81fbb537849190190516596c0c4a44be03728a408003039d82

      SHA512

      34d25b55546e242e5940ee7c891fb37b2ad257a06b91d87e56e47385495ec45386accfb91d405cedd673b4507ede392b3533b1a218a94e90adcfcf432c697eb4

    • C:\Users\Admin\AppData\Roaming\8vl94O51.exe
      Filesize

      519KB

      MD5

      0cc25540c7ea712231dfaa165733b316

      SHA1

      2c4398ac4c7e4ea2605a7f9cd96b8c15db743e35

      SHA256

      166af3429b6d9a81fbb537849190190516596c0c4a44be03728a408003039d82

      SHA512

      34d25b55546e242e5940ee7c891fb37b2ad257a06b91d87e56e47385495ec45386accfb91d405cedd673b4507ede392b3533b1a218a94e90adcfcf432c697eb4

    • C:\Users\Admin\AppData\Roaming\8vl94O51.exe
      Filesize

      519KB

      MD5

      0cc25540c7ea712231dfaa165733b316

      SHA1

      2c4398ac4c7e4ea2605a7f9cd96b8c15db743e35

      SHA256

      166af3429b6d9a81fbb537849190190516596c0c4a44be03728a408003039d82

      SHA512

      34d25b55546e242e5940ee7c891fb37b2ad257a06b91d87e56e47385495ec45386accfb91d405cedd673b4507ede392b3533b1a218a94e90adcfcf432c697eb4

    • C:\Users\Admin\TypeRes\DllResource.exe
      Filesize

      80.7MB

      MD5

      73be0b2f989f1cd0c019e98bd7d8a344

      SHA1

      a01c75acd8ac1411bfa091a99cdd1da34a0e971d

      SHA256

      9a195871ba95b67df4bbf17ff2c470ab62b69ad58a5cd01bc17bfaa1d907ff5c

      SHA512

      dba44c4443baf96f8189795975fc9e619ab619ea276f63faab4cf6df2dafa79bc4c21cf813465888707d16f00243b8dca95d9356465ac4bd0bcf7f7173904174

    • C:\Users\Admin\TypeRes\DllResource.exe
      Filesize

      83.9MB

      MD5

      d4f0c0fae4420a6552b764357885b431

      SHA1

      95ef63c3e21af389739c8bb608bb0b4ad4343b1f

      SHA256

      e487bd60c46dc5e65dc4d7727da0470fec73bdc6b58d0645795d1079dab7016e

      SHA512

      e50638ed4a6624a279bafd3a0e859ce2d4a53795f5af6590bc19d913c80df964f4565587a073fa649cebd69c68281ecea2367c901e7a764397a23cb53c2eb7e9

    • memory/228-170-0x0000000000400000-0x0000000000423000-memory.dmp
      Filesize

      140KB

    • memory/228-162-0x0000000000000000-mapping.dmp
    • memory/228-174-0x0000000000400000-0x0000000000423000-memory.dmp
      Filesize

      140KB

    • memory/228-172-0x0000000000400000-0x0000000000423000-memory.dmp
      Filesize

      140KB

    • memory/228-171-0x0000000000400000-0x0000000000423000-memory.dmp
      Filesize

      140KB

    • memory/228-168-0x0000000000400000-0x0000000000423000-memory.dmp
      Filesize

      140KB

    • memory/460-143-0x0000000000400000-0x0000000000414000-memory.dmp
      Filesize

      80KB

    • memory/460-141-0x0000000000400000-0x0000000000414000-memory.dmp
      Filesize

      80KB

    • memory/460-139-0x0000000000400000-0x0000000000414000-memory.dmp
      Filesize

      80KB

    • memory/460-138-0x0000000000000000-mapping.dmp
    • memory/460-145-0x0000000000400000-0x0000000000414000-memory.dmp
      Filesize

      80KB

    • memory/820-175-0x0000000000000000-mapping.dmp
    • memory/892-137-0x0000000010B50000-0x0000000010C16000-memory.dmp
      Filesize

      792KB

    • memory/892-136-0x0000000010B50000-0x0000000010C16000-memory.dmp
      Filesize

      792KB

    • memory/892-133-0x0000000002372000-0x00000000024B6000-memory.dmp
      Filesize

      1.3MB

    • memory/892-134-0x000000000257B000-0x0000000002BE5000-memory.dmp
      Filesize

      6.4MB

    • memory/892-144-0x0000000002372000-0x00000000024B6000-memory.dmp
      Filesize

      1.3MB

    • memory/892-135-0x0000000002372000-0x00000000024B6000-memory.dmp
      Filesize

      1.3MB

    • memory/892-132-0x000000000257B000-0x0000000002BE5000-memory.dmp
      Filesize

      6.4MB

    • memory/1324-179-0x0000000000000000-mapping.dmp
    • memory/1684-153-0x0000000000000000-mapping.dmp
    • memory/1684-160-0x0000000006AC0000-0x0000000006ACA000-memory.dmp
      Filesize

      40KB

    • memory/1684-156-0x00000000002F0000-0x0000000000374000-memory.dmp
      Filesize

      528KB

    • memory/1684-157-0x0000000005440000-0x00000000054DC000-memory.dmp
      Filesize

      624KB

    • memory/1684-158-0x0000000005AC0000-0x0000000006064000-memory.dmp
      Filesize

      5.6MB

    • memory/1684-159-0x00000000055B0000-0x0000000005642000-memory.dmp
      Filesize

      584KB

    • memory/3244-164-0x0000000000000000-mapping.dmp
    • memory/3976-176-0x0000000000000000-mapping.dmp
    • memory/3976-183-0x000000000245E000-0x0000000002BEE000-memory.dmp
      Filesize

      7.6MB

    • memory/4040-152-0x00000000022E0000-0x0000000002A70000-memory.dmp
      Filesize

      7.6MB

    • memory/4040-149-0x0000000000000000-mapping.dmp
    • memory/4040-163-0x00000000022E0000-0x0000000002A70000-memory.dmp
      Filesize

      7.6MB

    • memory/4040-161-0x0000000002A85000-0x0000000002C04000-memory.dmp
      Filesize

      1.5MB

    • memory/4040-167-0x0000000002A85000-0x0000000002C04000-memory.dmp
      Filesize

      1.5MB

    • memory/4040-180-0x0000000002A85000-0x0000000002C04000-memory.dmp
      Filesize

      1.5MB

    • memory/4208-182-0x0000000000000000-mapping.dmp
    • memory/4300-173-0x0000000000000000-mapping.dmp
    • memory/4560-181-0x0000000000000000-mapping.dmp