raccoon | 0025280674bfe3e54d490765fa720501d02e03c34bac501ca415d89b9621712d

Analysis

max time kernel
167s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22-02-2023 05:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AdobePremierePro.exe
Size

715.8MB
MD5

6ef8e38116dd5be6d51009fcbd8a8bf0
SHA1

d88e519d2f843eafd31f902d0530c008aa8daf51
SHA256

1517a5834abc8af4da1864e28a222837da00cfc8cb5cd0cd1c0110580209c727
SHA512

84cf126d6ee471b2df1f6479fa06dfabbfa41f8d320db40b87ab98989f659d166b3410999054e9974d2526dd7c6105ac319fc2a960c5b7ba5ae05f4b8abd1240
SSDEEP

1536:9rae78zjORCDGwfdCSog01313Ns5g531FECUA9lReMbP:TahKyd2n3165m3kfA9veML

Score

10^/10

raccoon 8fb7b851641d456f39570978e99f780e discovery persistence spyware stealer

Malware Config

Extracted

Family

raccoon

Botnet

8fb7b851641d456f39570978e99f780e

http://45.15.156.239/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

setupov380_5.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	setupov380_5.exe

Executes dropped EXE 4 IoCs

Processes:

setupov380_5.exesetupov380_5.exesetupov380_5.exesetupov380_5.exe

pid process

2656 setupov380_5.exe
4832 setupov380_5.exe
780 setupov380_5.exe
1204 setupov380_5.exe
Loads dropped DLL 3 IoCs

Processes:

setupov380_5.exe

pid process

1204 setupov380_5.exe
1204 setupov380_5.exe
1204 setupov380_5.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2656	setupov380_5.exe
4832	setupov380_5.exe
780	setupov380_5.exe
1204	setupov380_5.exe

pid	process
1204	setupov380_5.exe
1204	setupov380_5.exe
1204	setupov380_5.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

AdobePremierePro.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	AdobePremierePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	AdobePremierePro.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

setupov380_5.exe

description pid process target process

PID 2656 set thread context of 1204 2656 setupov380_5.exe setupov380_5.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 2656 set thread context of 1204	2656	setupov380_5.exe	setupov380_5.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exesetupov380_5.exepowershell.exe

pid	process
4836	powershell.exe
4836	powershell.exe
2656	setupov380_5.exe
2656	setupov380_5.exe
2656	setupov380_5.exe
2656	setupov380_5.exe
4056	powershell.exe
4056	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

setupov380_5.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2656 setupov380_5.exe
Token: SeDebugPrivilege 4836 powershell.exe
Token: SeDebugPrivilege 4056 powershell.exe

description	pid	process
Token: SeDebugPrivilege	2656	setupov380_5.exe
Token: SeDebugPrivilege	4836	powershell.exe
Token: SeDebugPrivilege	4056	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

AdobePremierePro.exesetupov380_5.execmd.exe

description	pid	process	target process
PID 228 wrote to memory of 2656	228	AdobePremierePro.exe	setupov380_5.exe
PID 228 wrote to memory of 2656	228	AdobePremierePro.exe	setupov380_5.exe
PID 228 wrote to memory of 2656	228	AdobePremierePro.exe	setupov380_5.exe
PID 2656 wrote to memory of 4836	2656	setupov380_5.exe	powershell.exe
PID 2656 wrote to memory of 4836	2656	setupov380_5.exe	powershell.exe
PID 2656 wrote to memory of 4836	2656	setupov380_5.exe	powershell.exe
PID 2656 wrote to memory of 4724	2656	setupov380_5.exe	cmd.exe
PID 2656 wrote to memory of 4724	2656	setupov380_5.exe	cmd.exe
PID 2656 wrote to memory of 4724	2656	setupov380_5.exe	cmd.exe
PID 2656 wrote to memory of 4832	2656	setupov380_5.exe	setupov380_5.exe
PID 2656 wrote to memory of 4832	2656	setupov380_5.exe	setupov380_5.exe
PID 2656 wrote to memory of 4832	2656	setupov380_5.exe	setupov380_5.exe
PID 2656 wrote to memory of 780	2656	setupov380_5.exe	setupov380_5.exe
PID 2656 wrote to memory of 780	2656	setupov380_5.exe	setupov380_5.exe
PID 2656 wrote to memory of 780	2656	setupov380_5.exe	setupov380_5.exe
PID 2656 wrote to memory of 1204	2656	setupov380_5.exe	setupov380_5.exe
PID 2656 wrote to memory of 1204	2656	setupov380_5.exe	setupov380_5.exe
PID 2656 wrote to memory of 1204	2656	setupov380_5.exe	setupov380_5.exe
PID 2656 wrote to memory of 1204	2656	setupov380_5.exe	setupov380_5.exe
PID 2656 wrote to memory of 1204	2656	setupov380_5.exe	setupov380_5.exe
PID 2656 wrote to memory of 1204	2656	setupov380_5.exe	setupov380_5.exe
PID 2656 wrote to memory of 1204	2656	setupov380_5.exe	setupov380_5.exe
PID 2656 wrote to memory of 1204	2656	setupov380_5.exe	setupov380_5.exe
PID 4724 wrote to memory of 4056	4724	cmd.exe	powershell.exe
PID 4724 wrote to memory of 4056	4724	cmd.exe	powershell.exe
PID 4724 wrote to memory of 4056	4724	cmd.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\AdobePremierePro.exe
"C:\Users\Admin\AppData\Local\Temp\AdobePremierePro.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:228

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov380_5.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov380_5.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2656

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4836

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
3⤵
- Suspicious use of WriteProcessMemory
PID:4724

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4056

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov380_5.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov380_5.exe
3⤵
- Executes dropped EXE
PID:4832

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov380_5.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov380_5.exe
3⤵
- Executes dropped EXE
PID:780

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov380_5.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov380_5.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1204

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\mozglue.dll
Filesize
612KB

MD5
f07d9977430e762b563eaadc2b94bbfa

SHA1
da0a05b2b8d269fb73558dfcf0ed5c167f6d3877

SHA256
4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862

SHA512
6afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf

Download Submit
C:\Users\Admin\AppData\LocalLow\nss3.dll
Filesize
1.9MB

MD5
f67d08e8c02574cbc2f1122c53bfb976

SHA1
6522992957e7e4d074947cad63189f308a80fcf2

SHA256
c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e

SHA512
2e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5

Download Submit
C:\Users\Admin\AppData\LocalLow\sqlite3.dll
Filesize
1.0MB

MD5
dbf4f8dcefb8056dc6bae4b67ff810ce

SHA1
bbac1dd8a07c6069415c04b62747d794736d0689

SHA256
47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68

SHA512
b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
1KB

MD5
4280e36a29fa31c01e4d8b2ba726a0d8

SHA1
c485c2c9ce0a99747b18d899b71dfa9a64dabe32

SHA256
e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

SHA512
494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Filesize
53KB

MD5
06ad34f9739c5159b4d92d702545bd49

SHA1
9152a0d4f153f3f40f7e606be75f81b582ee0c17

SHA256
474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

SHA512
c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
16KB

MD5
06af2a646d4dfab139906bc331391faf

SHA1
011a231ee65f5352d19a16d5773e1292d628cd7b

SHA256
2b4407142d7ead742c221b9f79586a801f76466f21130eea7d8b590dce4b674d

SHA512
c27db28e329d14d0959b99d0adbb73e0d84af1c5f120b0663116a99984b5f9dd3cb9542b5ea70e0ae6a4505bcce9ae44ab8b3bc274e41d646df1e5c61f6aee7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov380_5.exe
Filesize
362.4MB

MD5
f0b59fa0db273c90a0e1011fd9ed0276

SHA1
c9ee1b2a9e1e9073c7d4e5b58177192da3db46c8

SHA256
b0e588d0a6132bef2e786a32722259cf2e13e376ee68885d15c160508f97ad77

SHA512
c8ab66f6cbb3a9d2255e084bfa70c9c7c6e72cc376eafea58d0203aadd7433a4c8e4e87148bf849a7532505cb774e3db410216e5d4527996611892584ab68f70

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov380_5.exe
Filesize
362.4MB

MD5
f0b59fa0db273c90a0e1011fd9ed0276

SHA1
c9ee1b2a9e1e9073c7d4e5b58177192da3db46c8

SHA256
b0e588d0a6132bef2e786a32722259cf2e13e376ee68885d15c160508f97ad77

SHA512
c8ab66f6cbb3a9d2255e084bfa70c9c7c6e72cc376eafea58d0203aadd7433a4c8e4e87148bf849a7532505cb774e3db410216e5d4527996611892584ab68f70

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov380_5.exe
Filesize
362.4MB

MD5
f0b59fa0db273c90a0e1011fd9ed0276

SHA1
c9ee1b2a9e1e9073c7d4e5b58177192da3db46c8

SHA256
b0e588d0a6132bef2e786a32722259cf2e13e376ee68885d15c160508f97ad77

SHA512
c8ab66f6cbb3a9d2255e084bfa70c9c7c6e72cc376eafea58d0203aadd7433a4c8e4e87148bf849a7532505cb774e3db410216e5d4527996611892584ab68f70

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov380_5.exe
Filesize
362.4MB

MD5
f0b59fa0db273c90a0e1011fd9ed0276

SHA1
c9ee1b2a9e1e9073c7d4e5b58177192da3db46c8

SHA256
b0e588d0a6132bef2e786a32722259cf2e13e376ee68885d15c160508f97ad77

SHA512
c8ab66f6cbb3a9d2255e084bfa70c9c7c6e72cc376eafea58d0203aadd7433a4c8e4e87148bf849a7532505cb774e3db410216e5d4527996611892584ab68f70

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov380_5.exe
Filesize
362.4MB

MD5
f0b59fa0db273c90a0e1011fd9ed0276

SHA1
c9ee1b2a9e1e9073c7d4e5b58177192da3db46c8

SHA256
b0e588d0a6132bef2e786a32722259cf2e13e376ee68885d15c160508f97ad77

SHA512
c8ab66f6cbb3a9d2255e084bfa70c9c7c6e72cc376eafea58d0203aadd7433a4c8e4e87148bf849a7532505cb774e3db410216e5d4527996611892584ab68f70

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_druvycak.gri.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1204-169-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1204-250-0x0000000061E00000-0x0000000061EF1000-memory.dmp

Filesize
964KB

Download
memory/1204-185-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1204-251-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1204-173-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2656-138-0x00000000005B0000-0x00000000005BC000-memory.dmp

Filesize
48KB

Download
memory/2656-160-0x0000000004F70000-0x0000000004F80000-memory.dmp

Filesize
64KB

Download
memory/2656-140-0x00000000060E0000-0x0000000006102000-memory.dmp

Filesize
136KB

Download
memory/2656-139-0x0000000004F70000-0x0000000004F80000-memory.dmp

Filesize
64KB

Download
memory/4056-191-0x000000007F4D0000-0x000000007F4E0000-memory.dmp

Filesize
64KB

Download
memory/4056-190-0x0000000070AA0000-0x0000000070AEC000-memory.dmp

Filesize
304KB

Download
memory/4056-248-0x0000000007170000-0x0000000007178000-memory.dmp

Filesize
32KB

Download
memory/4056-247-0x0000000007190000-0x00000000071AA000-memory.dmp

Filesize
104KB

Download
memory/4056-240-0x0000000005AD0000-0x0000000005ADE000-memory.dmp

Filesize
56KB

Download
memory/4056-209-0x0000000004800000-0x0000000004810000-memory.dmp

Filesize
64KB

Download
memory/4056-207-0x0000000007230000-0x00000000072C6000-memory.dmp

Filesize
600KB

Download
memory/4056-187-0x0000000004800000-0x0000000004810000-memory.dmp

Filesize
64KB

Download
memory/4056-186-0x0000000004800000-0x0000000004810000-memory.dmp

Filesize
64KB

Download
memory/4056-203-0x0000000006FF0000-0x0000000006FFA000-memory.dmp

Filesize
40KB

Download
memory/4056-189-0x00000000061B0000-0x00000000061E2000-memory.dmp

Filesize
200KB

Download
memory/4056-201-0x0000000006220000-0x000000000623E000-memory.dmp

Filesize
120KB

Download
memory/4836-144-0x0000000005500000-0x0000000005566000-memory.dmp

Filesize
408KB

Download
memory/4836-163-0x0000000002550000-0x0000000002560000-memory.dmp

Filesize
64KB

Download
memory/4836-156-0x0000000005B70000-0x0000000005B8E000-memory.dmp

Filesize
120KB

Download
memory/4836-157-0x0000000002550000-0x0000000002560000-memory.dmp

Filesize
64KB

Download
memory/4836-158-0x00000000073E0000-0x0000000007A5A000-memory.dmp

Filesize
6.5MB

Download
memory/4836-154-0x0000000002550000-0x0000000002560000-memory.dmp

Filesize
64KB

Download
memory/4836-155-0x0000000002550000-0x0000000002560000-memory.dmp

Filesize
64KB

Download
memory/4836-143-0x00000000053E0000-0x0000000005446000-memory.dmp

Filesize
408KB

Download
memory/4836-159-0x0000000006070000-0x000000000608A000-memory.dmp

Filesize
104KB

Download
memory/4836-161-0x0000000002550000-0x0000000002560000-memory.dmp

Filesize
64KB

Download
memory/4836-162-0x0000000002550000-0x0000000002560000-memory.dmp

Filesize
64KB

Download
memory/4836-142-0x0000000004CC0000-0x00000000052E8000-memory.dmp

Filesize
6.2MB

Download
memory/4836-141-0x00000000025A0000-0x00000000025D6000-memory.dmp

Filesize
216KB

Download