raccoon | 015d7e09fabb3c9bf28ca4887830dcdecee775c490229b34c445ad06bf24ff6b

Analysis

max time kernel
74s
max time network
55s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22-02-2023 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CorelDraw.exe
Size

715.8MB
MD5

6ef8e38116dd5be6d51009fcbd8a8bf0
SHA1

d88e519d2f843eafd31f902d0530c008aa8daf51
SHA256

1517a5834abc8af4da1864e28a222837da00cfc8cb5cd0cd1c0110580209c727
SHA512

84cf126d6ee471b2df1f6479fa06dfabbfa41f8d320db40b87ab98989f659d166b3410999054e9974d2526dd7c6105ac319fc2a960c5b7ba5ae05f4b8abd1240
SSDEEP

1536:9rae78zjORCDGwfdCSog01313Ns5g531FECUA9lReMbP:TahKyd2n3165m3kfA9veML

Score

10^/10

raccoon 8fb7b851641d456f39570978e99f780e persistence stealer

Malware Config

Extracted

Family

raccoon

Botnet

8fb7b851641d456f39570978e99f780e

http://45.15.156.239/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Executes dropped EXE 2 IoCs

Processes:

setupov380_5.exesetupov380_5.exe

pid process

2024 setupov380_5.exe
1776 setupov380_5.exe
Loads dropped DLL 1 IoCs

Processes:

setupov380_5.exe

pid process

2024 setupov380_5.exe

pid	process
2024	setupov380_5.exe
1776	setupov380_5.exe

pid	process
2024	setupov380_5.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

CorelDraw.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	CorelDraw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	CorelDraw.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

setupov380_5.exe

description pid process target process

PID 2024 set thread context of 1776 2024 setupov380_5.exe setupov380_5.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

1748 powershell.exe
1492 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

setupov380_5.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2024 setupov380_5.exe
Token: SeDebugPrivilege 1748 powershell.exe
Token: SeDebugPrivilege 1492 powershell.exe

description	pid	process	target process
PID 2024 set thread context of 1776	2024	setupov380_5.exe	setupov380_5.exe

pid	process
1748	powershell.exe
1492	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2024	setupov380_5.exe
Token: SeDebugPrivilege	1748	powershell.exe
Token: SeDebugPrivilege	1492	powershell.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

CorelDraw.exesetupov380_5.execmd.exe

description	pid	process	target process
PID 1272 wrote to memory of 2024	1272	CorelDraw.exe	setupov380_5.exe
PID 1272 wrote to memory of 2024	1272	CorelDraw.exe	setupov380_5.exe
PID 1272 wrote to memory of 2024	1272	CorelDraw.exe	setupov380_5.exe
PID 1272 wrote to memory of 2024	1272	CorelDraw.exe	setupov380_5.exe
PID 1272 wrote to memory of 2024	1272	CorelDraw.exe	setupov380_5.exe
PID 1272 wrote to memory of 2024	1272	CorelDraw.exe	setupov380_5.exe
PID 1272 wrote to memory of 2024	1272	CorelDraw.exe	setupov380_5.exe
PID 2024 wrote to memory of 1748	2024	setupov380_5.exe	powershell.exe
PID 2024 wrote to memory of 1748	2024	setupov380_5.exe	powershell.exe
PID 2024 wrote to memory of 1748	2024	setupov380_5.exe	powershell.exe
PID 2024 wrote to memory of 1748	2024	setupov380_5.exe	powershell.exe
PID 2024 wrote to memory of 916	2024	setupov380_5.exe	cmd.exe
PID 2024 wrote to memory of 916	2024	setupov380_5.exe	cmd.exe
PID 2024 wrote to memory of 916	2024	setupov380_5.exe	cmd.exe
PID 2024 wrote to memory of 916	2024	setupov380_5.exe	cmd.exe
PID 916 wrote to memory of 1492	916	cmd.exe	powershell.exe
PID 916 wrote to memory of 1492	916	cmd.exe	powershell.exe
PID 916 wrote to memory of 1492	916	cmd.exe	powershell.exe
PID 916 wrote to memory of 1492	916	cmd.exe	powershell.exe
PID 2024 wrote to memory of 1776	2024	setupov380_5.exe	setupov380_5.exe
PID 2024 wrote to memory of 1776	2024	setupov380_5.exe	setupov380_5.exe
PID 2024 wrote to memory of 1776	2024	setupov380_5.exe	setupov380_5.exe
PID 2024 wrote to memory of 1776	2024	setupov380_5.exe	setupov380_5.exe
PID 2024 wrote to memory of 1776	2024	setupov380_5.exe	setupov380_5.exe
PID 2024 wrote to memory of 1776	2024	setupov380_5.exe	setupov380_5.exe
PID 2024 wrote to memory of 1776	2024	setupov380_5.exe	setupov380_5.exe
PID 2024 wrote to memory of 1776	2024	setupov380_5.exe	setupov380_5.exe
PID 2024 wrote to memory of 1776	2024	setupov380_5.exe	setupov380_5.exe
PID 2024 wrote to memory of 1776	2024	setupov380_5.exe	setupov380_5.exe
PID 2024 wrote to memory of 1776	2024	setupov380_5.exe	setupov380_5.exe
PID 2024 wrote to memory of 1776	2024	setupov380_5.exe	setupov380_5.exe

C:\Users\Admin\AppData\Local\Temp\CorelDraw.exe
"C:\Users\Admin\AppData\Local\Temp\CorelDraw.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1272

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov380_5.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov380_5.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1748

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
3⤵
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1492

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov380_5.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov380_5.exe
3⤵
- Executes dropped EXE
PID:1776

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov380_5.exe
Filesize
362.4MB

MD5
f0b59fa0db273c90a0e1011fd9ed0276

SHA1
c9ee1b2a9e1e9073c7d4e5b58177192da3db46c8

SHA256
b0e588d0a6132bef2e786a32722259cf2e13e376ee68885d15c160508f97ad77

SHA512
c8ab66f6cbb3a9d2255e084bfa70c9c7c6e72cc376eafea58d0203aadd7433a4c8e4e87148bf849a7532505cb774e3db410216e5d4527996611892584ab68f70

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov380_5.exe
Filesize
362.4MB

MD5
f0b59fa0db273c90a0e1011fd9ed0276

SHA1
c9ee1b2a9e1e9073c7d4e5b58177192da3db46c8

SHA256
b0e588d0a6132bef2e786a32722259cf2e13e376ee68885d15c160508f97ad77

SHA512
c8ab66f6cbb3a9d2255e084bfa70c9c7c6e72cc376eafea58d0203aadd7433a4c8e4e87148bf849a7532505cb774e3db410216e5d4527996611892584ab68f70

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov380_5.exe
Filesize
362.4MB

MD5
f0b59fa0db273c90a0e1011fd9ed0276

SHA1
c9ee1b2a9e1e9073c7d4e5b58177192da3db46c8

SHA256
b0e588d0a6132bef2e786a32722259cf2e13e376ee68885d15c160508f97ad77

SHA512
c8ab66f6cbb3a9d2255e084bfa70c9c7c6e72cc376eafea58d0203aadd7433a4c8e4e87148bf849a7532505cb774e3db410216e5d4527996611892584ab68f70

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\BN6VV9NSD3V9NPB7Z7ZT.temp
Filesize
7KB

MD5
0bcd04da145ccb81671ee94c320a5cf8

SHA1
5a130cad3f31c966b8bafedf3cfbd004ecadeb1a

SHA256
85db9132280e1005afd250b4a84ec7c067bed7804deb4408e64b1142dde48fc7

SHA512
a40aa37e564d7991311dae260b566c3c5dc9abff359549c49f4635217fffd8d78a4061b46c1ebe740401557a5ab7d47da933422bb701bf19bfe422a8af176932

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
0bcd04da145ccb81671ee94c320a5cf8

SHA1
5a130cad3f31c966b8bafedf3cfbd004ecadeb1a

SHA256
85db9132280e1005afd250b4a84ec7c067bed7804deb4408e64b1142dde48fc7

SHA512
a40aa37e564d7991311dae260b566c3c5dc9abff359549c49f4635217fffd8d78a4061b46c1ebe740401557a5ab7d47da933422bb701bf19bfe422a8af176932

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov380_5.exe
Filesize
362.4MB

MD5
f0b59fa0db273c90a0e1011fd9ed0276

SHA1
c9ee1b2a9e1e9073c7d4e5b58177192da3db46c8

SHA256
b0e588d0a6132bef2e786a32722259cf2e13e376ee68885d15c160508f97ad77

SHA512
c8ab66f6cbb3a9d2255e084bfa70c9c7c6e72cc376eafea58d0203aadd7433a4c8e4e87148bf849a7532505cb774e3db410216e5d4527996611892584ab68f70

Download Submit
memory/1492-86-0x00000000029A0000-0x00000000029E0000-memory.dmp

Filesize
256KB

Download
memory/1492-87-0x00000000029A0000-0x00000000029E0000-memory.dmp

Filesize
256KB

Download
memory/1492-85-0x00000000029A0000-0x00000000029E0000-memory.dmp

Filesize
256KB

Download
memory/1748-67-0x00000000022E0000-0x0000000002320000-memory.dmp

Filesize
256KB

Download
memory/1748-68-0x00000000022E0000-0x0000000002320000-memory.dmp

Filesize
256KB

Download
memory/1748-69-0x00000000022E0000-0x0000000002320000-memory.dmp

Filesize
256KB

Download
memory/1776-82-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1776-72-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1776-79-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1776-80-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1776-81-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1776-75-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2024-61-0x0000000001360000-0x00000000013A0000-memory.dmp

Filesize
256KB

Download
memory/2024-64-0x0000000001360000-0x00000000013A0000-memory.dmp

Filesize
256KB

Download
memory/2024-60-0x00000000013A0000-0x00000000013AC000-memory.dmp

Filesize
48KB

Download
memory/2024-62-0x0000000005A30000-0x0000000005ADE000-memory.dmp

Filesize
696KB

Download
memory/2024-63-0x0000000000350000-0x0000000000364000-memory.dmp

Filesize
80KB

Download