raccoon | 759a3d7922ff0e127eb806a42d923c6cc476e79c6ffe58184dccfea09e2e1615

Analysis

max time kernel
151s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2022, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AppSetup.exe
Size 650.1MB
Sample221110-sha6nacfdr
SHA256 62b29df449c6e8167204656a2a6fa6cc514ca95d3bb004b16efd12fb4af1af2a
MD5 7736748371d773cb0a28c2397a3dc062
SHA1 467be21544ab90ac6ba9ea5c41d44f33670fff3e
SHA512 cde064be4e8995674dea2c11dcddb5229738a761b7a66fbdd85e75a38447d3ec201375b8a0e9180e8bd4bd0d081180d38b68acdfd5838e85dd2a4f0eb816a5bc
SSDEEP 12288:jz9BX+pxkKjVpN+y5bFOxI0cHsfgkaHGw6JV/tyYhBcT9t:jhoDpjVpN1b8xGHWgJmwy/tyjxt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

raccoon eb460bbba07d79175f5b5a9df57f482b persistence stealer

Malware Config

Extracted

Family

raccoon

Botnet

eb460bbba07d79175f5b5a9df57f482b

http://172.86.120.42/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Executes dropped EXE 2 IoCs

pid	Process
4744	Collaboration.exe.pif
1112	Collaboration.exe.pif

Loads dropped DLL 6 IoCs

pid	Process
4744	Collaboration.exe.pif
4744	Collaboration.exe.pif
4744	Collaboration.exe.pif
4744	Collaboration.exe.pif
4744	Collaboration.exe.pif
4744	Collaboration.exe.pif

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	AppSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	AppSetup.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4744 set thread context of 1112	4744	Collaboration.exe.pif	99

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
1744	tasklist.exe
4368	tasklist.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1568	PING.EXE
2768	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4744	Collaboration.exe.pif
4744	Collaboration.exe.pif
4744	Collaboration.exe.pif
4744	Collaboration.exe.pif
4744	Collaboration.exe.pif
4744	Collaboration.exe.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1744	tasklist.exe
Token: SeDebugPrivilege	4368	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4744	Collaboration.exe.pif
4744	Collaboration.exe.pif
4744	Collaboration.exe.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4744	Collaboration.exe.pif
4744	Collaboration.exe.pif
4744	Collaboration.exe.pif

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 4264	2092	AppSetup.exe	79
PID 2092 wrote to memory of 4264	2092	AppSetup.exe	79
PID 2092 wrote to memory of 4264	2092	AppSetup.exe	79
PID 2092 wrote to memory of 5036	2092	AppSetup.exe	81
PID 2092 wrote to memory of 5036	2092	AppSetup.exe	81
PID 2092 wrote to memory of 5036	2092	AppSetup.exe	81
PID 5036 wrote to memory of 4956	5036	cmd.exe	83
PID 5036 wrote to memory of 4956	5036	cmd.exe	83
PID 5036 wrote to memory of 4956	5036	cmd.exe	83
PID 4956 wrote to memory of 1744	4956	cmd.exe	84
PID 4956 wrote to memory of 1744	4956	cmd.exe	84
PID 4956 wrote to memory of 1744	4956	cmd.exe	84
PID 4956 wrote to memory of 880	4956	cmd.exe	85
PID 4956 wrote to memory of 880	4956	cmd.exe	85
PID 4956 wrote to memory of 880	4956	cmd.exe	85
PID 4956 wrote to memory of 4368	4956	cmd.exe	86
PID 4956 wrote to memory of 4368	4956	cmd.exe	86
PID 4956 wrote to memory of 4368	4956	cmd.exe	86
PID 4956 wrote to memory of 2280	4956	cmd.exe	87
PID 4956 wrote to memory of 2280	4956	cmd.exe	87
PID 4956 wrote to memory of 2280	4956	cmd.exe	87
PID 4956 wrote to memory of 1828	4956	cmd.exe	88
PID 4956 wrote to memory of 1828	4956	cmd.exe	88
PID 4956 wrote to memory of 1828	4956	cmd.exe	88
PID 4956 wrote to memory of 4744	4956	cmd.exe	89
PID 4956 wrote to memory of 4744	4956	cmd.exe	89
PID 4956 wrote to memory of 4744	4956	cmd.exe	89
PID 4956 wrote to memory of 2768	4956	cmd.exe	90
PID 4956 wrote to memory of 2768	4956	cmd.exe	90
PID 4956 wrote to memory of 2768	4956	cmd.exe	90
PID 5036 wrote to memory of 1568	5036	cmd.exe	92
PID 5036 wrote to memory of 1568	5036	cmd.exe	92
PID 5036 wrote to memory of 1568	5036	cmd.exe	92
PID 4744 wrote to memory of 1112	4744	Collaboration.exe.pif	99
PID 4744 wrote to memory of 1112	4744	Collaboration.exe.pif	99
PID 4744 wrote to memory of 1112	4744	Collaboration.exe.pif	99
PID 4744 wrote to memory of 1112	4744	Collaboration.exe.pif	99
PID 4744 wrote to memory of 1112	4744	Collaboration.exe.pif	99

C:\Users\Admin\AppData\Local\Temp\AppSetup.exe
"C:\Users\Admin\AppData\Local\Temp\AppSetup.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\bitsadmin.exe
  bitsadmin bitsadmin bitsadmin bitsadmin bitsadmin bitsadmin bitsadmin
  2⤵
  PID:4264
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Preferences.vsd & ping -n 5 localhost
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4956
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "imagename eq AvastUI.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1744
  - - C:\Windows\SysWOW64\find.exe
      find /I /N "avastui.exe"
      4⤵
      PID:880
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "imagename eq AVGUI.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4368
  - - C:\Windows\SysWOW64\find.exe
      find /I /N "avgui.exe"
      4⤵
      PID:2280
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^zsXAL$" Simulation.vsd
      4⤵
      PID:1828
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Collaboration.exe.pif
      Collaboration.exe.pif f
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Collaboration.exe.pif
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Collaboration.exe.pif
        5⤵
        Executes dropped EXE
        
        PID:1112
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 5
      4⤵
      Runs ping.exe
      PID:2768
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 5 localhost
    3⤵
    - Runs ping.exe
    PID:1568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Collaboration.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Collaboration.exe.pif
Size 924KB
SHA256 3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
MD5 6987e4cd3f256462f422326a7ef115b9
SHA1 71672a495b4603ecfec40a65254cb3ba8766bbe0
SHA512 4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
SSDEEP 24576:LErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:L86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Collaboration.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Collaboration.exe.pif
Size 924KB
SHA256 3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
MD5 6987e4cd3f256462f422326a7ef115b9
SHA1 71672a495b4603ecfec40a65254cb3ba8766bbe0
SHA512 4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
SSDEEP 24576:LErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:L86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Collaboration.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Collaboration.exe.pif
Size 924KB
SHA256 3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
MD5 6987e4cd3f256462f422326a7ef115b9
SHA1 71672a495b4603ecfec40a65254cb3ba8766bbe0
SHA512 4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
SSDEEP 24576:LErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:L86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kuwait.vsd

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Kuwait.vsd
Size 641KB
SHA256 652e5a9fcc878c05de86398906274ef91907d467ed96700c9923c0dd014b07b4
MD5 65bb3c21cdbb2eba2ad83573bdd88fe2
SHA1 44121dad3ec54678a480eac815fa9cfe1eb36e08
SHA512 a4eda6810a72a28601080c491ff17e6bbe4c29e1e57594aaeff3348af349b7a813ca9d36f1395c00115d89ce8c6eccdc4de9914bc03685a5644e148f774414cc
SSDEEP 6144:9Aguf7lfFfLf3qZhKIdEm/H4Ld3fY8B7y3I4LXFjFJ7MC1IeDj7D8V5nIkj7exsj:9AF2Z2mAJA8xH+FjFyC1IeDjsIOzFN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences.vsd

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Preferences.vsd
Size 10KB
SHA256 4e61373f8e2216b95f7bdbd76321c18225aab264907f8f41b52cc376f54e27d9
MD5 46b4704006f26abd2d2ff9139fcc124a
SHA1 9d611358864dc3ac20107755774b2a50a7f51493
SHA512 8fd3e1bb87e826b5047ddbec0ab02c3230ff1b6d8ea709593341898aed813e3baa5d0c17961cb0ed0c129012bf8f4e33f7ac7bf3d0bd74e3d9aab717d6ebdcb2
SSDEEP 192:gvS6QZKeemDGhumaIJJXXipZqnYlx+gOLZPwJiOrxPwJEzd3N:nVElmaDaNZ6K+DLZwVrxwS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Simulation.vsd

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Simulation.vsd
Size 924KB
SHA256 b6031d6424a4221830e29153fc7125dbd251b454539de76fee852a6875840431
MD5 75d2326d2d1bb6de24f3dda341482c13
SHA1 38c9138a24824073eef171cf365ebb01a2c4937f
SHA512 b3521bdc95c871ffb8f5866f2f9699ed8343715437e40f9da42a4740e1b279ddb6d4aa85229485baf8331bba5868c4299860031888c322e96b29ce6aa3761dc3
SSDEEP 24576:dErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:d86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

kprGKGWkWrUJt.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kprGKGWkWrUJt.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

kprGKGWkWrUJt.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kprGKGWkWrUJt.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

kprGKGWkWrUJt.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kprGKGWkWrUJt.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

kprGKGWkWrUJt.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kprGKGWkWrUJt.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

kprGKGWkWrUJt.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kprGKGWkWrUJt.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

kprGKGWkWrUJt.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kprGKGWkWrUJt.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1112-159-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1112-160-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1112-153-0x0000000000400000-0x0000000000412000-memory.dmp

Download