Overview

overview

10

Static

static

1

AdobePremierePro.exe

windows7-x64

10

AdobePremierePro.exe

windows10-2004-x64

10

port/cont/...cl.dll

windows7-x64

3

port/cont/...cl.dll

windows10-2004-x64

3

port/cont/...up.dll

windows7-x64

1

port/cont/...up.dll

windows10-2004-x64

1

port/cont/...PT.exe

windows7-x64

1

port/cont/...PT.exe

windows10-2004-x64

1

port/cont/...mg.dll

windows7-x64

1

port/cont/...mg.dll

windows10-2004-x64

1

port/cont/...es.dll

windows7-x64

1

port/cont/...es.dll

windows10-2004-x64

1

port/cont/...ce.dll

windows7-x64

1

port/cont/...ce.dll

windows10-2004-x64

1

port/cont/...it.dll

windows7-x64

1

port/cont/...it.dll

windows10-2004-x64

1

port/cont/...ns.dll

windows7-x64

1

port/cont/...ns.dll

windows10-2004-x64

1

port/det/D...ov.dll

windows7-x64

1

port/det/D...ov.dll

windows10-2004-x64

1

port/det/MSVidCtl.dll

windows7-x64

1

port/det/MSVidCtl.dll

windows10-2004-x64

1

port/det/migstore.dll

windows7-x64

1

port/det/migstore.dll

windows10-2004-x64

1

port/det/msftedit.dll

windows7-x64

1

port/det/msftedit.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AdobePremierePro.rar

  • Size

    5.9MB

  • Sample

    230222-f5cxjsaa48

  • MD5

    6f1f7a837decd50809a0c15e72d25257

  • SHA1

    900ba83501651a500255951433187d446fda15f4

  • SHA256

    0025280674bfe3e54d490765fa720501d02e03c34bac501ca415d89b9621712d

  • SHA512

    47ac3b65f5deb77446b4cb1581de530d49adb78a37017bdfeffb66a6a001dec784ac09ff53684a198004d08462280956ee2dac652f56e6180ae972bf9c62e5f7

  • SSDEEP

    98304:a6gkJu1222JoVEp8XZDeRSSyNu6t+loWBm2LJ+s2iLsxJ0HDPTqjE7U:pJuIbJoVEp8XJjSy86rY+s2YcJ0HD7pY

Score
10/10
raccoon8fb7b851641d456f39570978e99f780ediscoverypersistencespywarestealer

Malware Config

Extracted

Family

raccoon

Botnet

8fb7b851641d456f39570978e99f780e

C2

http://45.15.156.239/

rc4.plain

Targets

    • Target

      AdobePremierePro.exe

    • Size

      715.8MB

    • MD5

      6ef8e38116dd5be6d51009fcbd8a8bf0

    • SHA1

      d88e519d2f843eafd31f902d0530c008aa8daf51

    • SHA256

      1517a5834abc8af4da1864e28a222837da00cfc8cb5cd0cd1c0110580209c727

    • SHA512

      84cf126d6ee471b2df1f6479fa06dfabbfa41f8d320db40b87ab98989f659d166b3410999054e9974d2526dd7c6105ac319fc2a960c5b7ba5ae05f4b8abd1240

    • SSDEEP

      1536:9rae78zjORCDGwfdCSog01313Ns5g531FECUA9lReMbP:TahKyd2n3165m3kfA9veML

    Score
    10/10
    raccoon8fb7b851641d456f39570978e99f780epersistencestealerdiscoveryspyware

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      port/cont/rich/kaps/unbcl.dll

    • Size

      1.0MB

    • MD5

      75beda2b1a92744dbb05878e4491dde4

    • SHA1

      50e01b391b711c92046183a28df3eb0e92c29128

    • SHA256

      b6e98f66ae143bc38e5381fa8c0d99e58434169f25202e520664419c2b35412b

    • SHA512

      81359115deac81e540a1c6f95b6ee8bc57adbc7e514c5c997dcd05e20333ef3b6f52214de74bdc7b55471cfd7be5fb53dc1712cef416b7e9037d030c6c7a2b5b

    • SSDEEP

      12288:UpiYCl2vyrqmx32Mfban+AYMTkgWOS42xGeyz:yiYC0vymu3rbGiMT5WOS42xG7

    Score
    3/10
    behavioral3behavioral4

    • Target

      port/cont/rich/kaps/winsetup.dll

    • Size

      3.5MB

    • MD5

      b6a2e94c56a141b004e400358e72ce79

    • SHA1

      fe3a749812c0014d7810b4bc5e2f849384cd9e31

    • SHA256

      2b40132fa4e1c3de5e70d57935e2c99de437f69ae934a70243dae9a0ce3ca6c2

    • SHA512

      a31dce366e5d1a53821ea4db01d3f7b1924be9bf5c8e0ab74aadf48c1b6f85d4c7656eecfc0bc9cce915b765589b4bb9c324dce21ae5eae1f4f8774bb6b282a3

    • SSDEEP

      49152:NHSWbyqeCs3pbW5O/hPMiyYbR6BjG0eFHt6Hfp9pt8/s2tyml418:I/6dYbR6e69ncymz

    Score
    1/10
    behavioral5behavioral6

    • Target

      port/cont/rich/oope/MBR2GPT.EXE

    • Size

      1.1MB

    • MD5

      4bfd587c99fe34eea0e74622c798b3be

    • SHA1

      39309fc62dadffb36a6ee75de6194121be206728

    • SHA256

      5a54bb94f6756deafc0bf25c9eca4e9dea00ddc3af293479bc7c3380f1be30ea

    • SHA512

      f5ea0477c1c1683fc8c9f5fa7d5071ffc276f4cbf5f9b78dd9529cc20ca0905a60a123cd82bf5ac26f1b83ba0c732c5d9ca8b336275d799a8518179cb0c5adc3

    • SSDEEP

      24576:h6kHNg53pIE1OJmPJQ3IKxw9EdE+1Hii1:h6UGpAmcIJIZio

    Score
    1/10
    behavioral7behavioral8

    • Target

      port/cont/rich/oope/W32UIImg.dll

    • Size

      2.8MB

    • MD5

      f3997597c98028d1f72e431fe86bf86b

    • SHA1

      061207c2ea0b449a4fb73e15e43d49c37c22d802

    • SHA256

      3ab6dba6eaa7f19e4e0ea4b07aed1e3ae9662a091648bfbf66f7fba0f436c321

    • SHA512

      2392a281c5ad546cf0acf4e94c5d8e535de4f34063fb9e47867297ec5f3297e5c551e1d764b3dd1357756cc6c5263acd26fa86968b903f67ad2dfb03b93ffb89

    • SSDEEP

      12288:quSqSvMTuSqSvM6agvGokAAQ4UPTyiJVI:quSqtTuSqtT0RK

    Score
    1/10
    behavioral10behavioral9

    • Target

      port/cont/rich/oope/W32UIRes.dll

    • Size

      208KB

    • MD5

      2819767cd9b7f93238144c4b3abb97d4

    • SHA1

      2a303acc5ff85a58d2aa1d1b7fdc2077e430b331

    • SHA256

      36fa6e3c584a9d03d6063c10c218c2090498a6885de8e3d023867cb849129550

    • SHA512

      6df3e8b07ae730f24217aeaba03ce97858aab4142bbda6025353d9ffaea2615ab4531143c61c6b2cd68ae19f71156efd0d5fe24e036b498cacffa52609c91f1d

    • SSDEEP

      1536:FkzzzOMdAV8yEyePaauLXLbfm2Xp0jcM2qKMtzgeO971OuvQwyV/PcBpz+:6zzzOMSLnKuwUePuvQwaUra

    Score
    1/10
    behavioral11behavioral12

    • Target

      port/cont/rich/oope/mispace.dll

    • Size

      3.0MB

    • MD5

      266194e2736b2a7c190bc5da47ec9a7a

    • SHA1

      d48f34acff6173fd061ca8e79b1f008e900bda94

    • SHA256

      efd677146e0cf80583dcd466e2ecf1c8c3ed58d0a502a4f306a6d414ac80e2e4

    • SHA512

      7a90f1eab18a87d5211d96caaafa9fa7930d70e23cee3dde1b569166dce86b1aa62ad755fd79205ac4270c8af2e1b834a639ef95187fe860574873959d97a7f5

    • SSDEEP

      24576:AC/2Yq4Ggm7t08aRsxBX5OJwma0UjrYAaCDmNz8W0uUEfTBH4LodcadX7e:ACukGjYaTrc8mexUfTBH4L8Xy

    Score
    1/10
    behavioral13behavioral14

    • Target

      port/cont/rich/oope/msftedit.dll

    • Size

      3.2MB

    • MD5

      ad8d5b57063dda8523c2f653fc8e93e9

    • SHA1

      0d59f82d22d0f483f4553681a89e0f5bb533f944

    • SHA256

      b458aecce93656141538b2aab988e382ce8d6b376a42b05313b701874a4c2e55

    • SHA512

      417dabf27b5761692011ada6a5c87e13953d58e2045c985a9a45825be2cae5fff9246e2b0708875a4777cecf75c2628e9dd56616466e15b1fd0153dc39af78b6

    • SSDEEP

      49152:Sl6/Qm3K8bGgu0K3IBnlOq3lrUCBmLUI4oPSfvKqXPeh3ZNwEsoYb9wX5zonj16T:TzS+lBU4oP0Ze4+

    Score
    1/10
    behavioral15behavioral16

    • Target

      port/cont/rich/oope/msoobeplugins.dll

    • Size

      1.1MB

    • MD5

      b165f259cf4d1d25bbdffa1cc676dfb6

    • SHA1

      4277abb99956e8ea1517f68cbed19292240a93b2

    • SHA256

      d19748fa57ab5f4692fb6e19a189caf72be3754227acfde7d6cc9e3712480465

    • SHA512

      fad6a857f2a96f387f412713268eff2cd2338c5bfbd98a75a237d7e93def9d3225f7bed2abcb2b84bd9aef626a9d4d6bb1eb22eb2d1fcd5ce9bef9fffe452ac4

    • SSDEEP

      12288:REadEKSpoTMRwvzgi5e7oxEu1HoYV8UqK8Q7YatVswMkw97:RTLwRNi5eo6co89qBQ7Yh4w

    Score
    1/10
    behavioral17behavioral18

    • Target

      port/det/DMWmiBridgeProv.dll

    • Size

      4.2MB

    • MD5

      e246609fb36a7acf63392533e48c285e

    • SHA1

      99dea381d15b2af7e68cfed5f9d75c33c8be8a12

    • SHA256

      ef7da20805406961052d0146cec2c7f1b5ba4db17a114e15a237f33e5768e7cb

    • SHA512

      e29279134cf4b81fde4bdba36c484d839eff3a2a7ca191d004e984e847488441b97b4830d3198149f26d54e3d1bf9e3cf4e29d58008e0c3b1876c057463cd6a5

    • SSDEEP

      49152:aRA/BFSzrERnqG8eHH5UmdSqr2KjUQqTjU/4xFcGw:aRQDUSr2q6Fx

    Score
    1/10
    behavioral19behavioral20

    • Target

      port/det/MSVidCtl.dll

    • Size

      3.3MB

    • MD5

      6a93c400f7d5bcf8799c0506531f7d12

    • SHA1

      f8ecd93adfc87ae76970656bd15af3a960a83428

    • SHA256

      6679297f7e7f17ef37f48fa25f070d78e76324d167aa8b961d85327321e58754

    • SHA512

      209476a382bce5b53762b52c5b9f3f1bcb0d1f3b3763d1c8aa3ed6c1af838d4b442ffd7a40eb851a6c36a462031ee5fda5617dae5348426f7de3ef73b2aaec6d

    • SSDEEP

      49152:GRVfgoQrkv0BzBQLW6Ki8gT3lZhrnxySgnpO91MmIusURfvxmtdl:GRVfgoQrkv0BVi8gT3r9xyS1jzfvx

    Score
    1/10
    behavioral21behavioral22

    • Target

      port/det/migstore.dll

    • Size

      1.2MB

    • MD5

      6edfa6fee4f91d989f0c95add39013f4

    • SHA1

      c7e06bc42d0b9bb318aa604c7f8d009be3c4718a

    • SHA256

      acb06cf520fa85c3929645c88d99ceb454bad6a9cb9642097b4b9b8a3504d4bf

    • SHA512

      d6ff5655e9d434ea881072452a22d9441a3214d6ad08c16d5abc124ff569b0fb6b7deae0ffa8834486decec2247c92950d4d6baacf72ca87d45dda25ea6eb120

    • SSDEEP

      12288:AEQz64gymq0bj97S1JzTtYZF1oj9JOx3CxGlEEbxdpU+:AEQO4gymq0bj97S1VGF1oBJORCxONo+

    Score
    1/10
    behavioral23behavioral24

    • Target

      port/det/msftedit.dll

    • Size

      3.2MB

    • MD5

      ad8d5b57063dda8523c2f653fc8e93e9

    • SHA1

      0d59f82d22d0f483f4553681a89e0f5bb533f944

    • SHA256

      b458aecce93656141538b2aab988e382ce8d6b376a42b05313b701874a4c2e55

    • SHA512

      417dabf27b5761692011ada6a5c87e13953d58e2045c985a9a45825be2cae5fff9246e2b0708875a4777cecf75c2628e9dd56616466e15b1fd0153dc39af78b6

    • SSDEEP

      49152:Sl6/Qm3K8bGgu0K3IBnlOq3lrUCBmLUI4oPSfvKqXPeh3ZNwEsoYb9wX5zonj16T:TzS+lBU4oP0Ze4+

    Score
    1/10
    behavioral25behavioral26

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks