raccoon | 0ff95f89a44883b00a42d4eb46787aefc3f687067e48734699f504e300ff14fd

Analysis

max time kernel
177s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4eb5b5fc2b10f0e083e1d4682ce42d36.exe
Size

4.4MB
MD5

4eb5b5fc2b10f0e083e1d4682ce42d36
SHA1

610e3067ca1047ac4c4ccfabee6fe30c8d76f211
SHA256

0ff95f89a44883b00a42d4eb46787aefc3f687067e48734699f504e300ff14fd
SHA512

c24fe0dcb0cd08c275eb029dd5f5e10c996b3081ea30d1e0cabe2b6c91394cae6833d7546b5243eac13660dae46f3c22f994fb61ec38eaf99220db35f3e1291d
SSDEEP

98304:FKXNudxHYcv5N+LLR+oiozIP/bEdlrEw7UwNeL7goFbPB4/pb:FZvf+HR1iozIHKwwYfLLBkpb

Score

10^/10

raccoon 94c54520400750937a6f1bf6044f8667 evasion stealer trojan

Malware Config

Extracted

Family

raccoon

Botnet

94c54520400750937a6f1bf6044f8667

http://194.37.80.221/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

4eb5b5fc2b10f0e083e1d4682ce42d36.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4eb5b5fc2b10f0e083e1d4682ce42d36.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4eb5b5fc2b10f0e083e1d4682ce42d36.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4eb5b5fc2b10f0e083e1d4682ce42d36.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4eb5b5fc2b10f0e083e1d4682ce42d36.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4eb5b5fc2b10f0e083e1d4682ce42d36.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

4eb5b5fc2b10f0e083e1d4682ce42d36.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4eb5b5fc2b10f0e083e1d4682ce42d36.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

4eb5b5fc2b10f0e083e1d4682ce42d36.exe

pid process

3232 4eb5b5fc2b10f0e083e1d4682ce42d36.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

4eb5b5fc2b10f0e083e1d4682ce42d36.exe

pid process

3232 4eb5b5fc2b10f0e083e1d4682ce42d36.exe
3232 4eb5b5fc2b10f0e083e1d4682ce42d36.exe

pid	process
3232	4eb5b5fc2b10f0e083e1d4682ce42d36.exe

pid	process
3232	4eb5b5fc2b10f0e083e1d4682ce42d36.exe
3232	4eb5b5fc2b10f0e083e1d4682ce42d36.exe

C:\Users\Admin\AppData\Local\Temp\4eb5b5fc2b10f0e083e1d4682ce42d36.exe
"C:\Users\Admin\AppData\Local\Temp\4eb5b5fc2b10f0e083e1d4682ce42d36.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3232-132-0x0000000000400000-0x0000000000D91000-memory.dmp

Filesize
9.6MB

Download
memory/3232-133-0x0000000000400000-0x0000000000D91000-memory.dmp

Filesize
9.6MB

Download
memory/3232-135-0x0000000000400000-0x0000000000D91000-memory.dmp

Filesize
9.6MB

Download
memory/3232-137-0x0000000077120000-0x00000000772C3000-memory.dmp

Filesize
1.6MB

Download
memory/3232-136-0x0000000000400000-0x0000000000D91000-memory.dmp

Filesize
9.6MB

Download
memory/3232-138-0x0000000000400000-0x0000000000D91000-memory.dmp

Filesize
9.6MB

Download
memory/3232-139-0x0000000077120000-0x00000000772C3000-memory.dmp

Filesize
1.6MB

Download
memory/3232-140-0x0000000000400000-0x0000000000D91000-memory.dmp

Filesize
9.6MB

Download
memory/3232-141-0x0000000077120000-0x00000000772C3000-memory.dmp

Filesize
1.6MB

Download