raccoon | 968c44669316afd10647241ac2ec0fb93791863d3b41075be3f382b093fa516c

Analysis

max time kernel
1552s
max time network
1590s
platform
windows10-2004_x64
resource
win10v2004-20230221-es
resource tags

arch:x64arch:x86image:win10v2004-20230221-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
06-04-2023 02:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Active_Version_Fully_Setups.rar
Size

12.4MB
MD5

f588b0444462c53360663ac435c60449
SHA1

76bc144accf885d58cf3d814e1e00fe0c9f00455
SHA256

968c44669316afd10647241ac2ec0fb93791863d3b41075be3f382b093fa516c
SHA512

0238e5634adaf0f31b648f76face0759a4329d5a138206da943af993e160137e813b728efa49fa4be1a5a3e8318e9573ff6715f1be80a769ca53b731865a16dc
SSDEEP

196608:I/XrZIOLnKVrhzzAhebMXdPmsdKE4VzolZ6AOv3uMbwWwtO7ufVE07oXEt2B2Ah:I6CE1zuOMNPFKE4V61OPnbwF60+Fh

Score

10^/10

raccoon 13718a923845c0cdab8ce45c585b8d63 stealer

Malware Config

Extracted

Family

raccoon

Botnet

13718a923845c0cdab8ce45c585b8d63

http://45.15.156.143/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Executes dropped EXE 1 IoCs

Processes:

Satups.exe

pid process

5032 Satups.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
5032	Satups.exe

Modifies registry class 2 IoCs

Processes:

OpenWith.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Satups.exe

pid process

5032 Satups.exe
5032 Satups.exe

pid	process
5032	Satups.exe
5032	Satups.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

7zG.exe7zG.exe

description	pid	process
Token: SeRestorePrivilege	3728	7zG.exe
Token: 35	3728	7zG.exe
Token: SeSecurityPrivilege	3728	7zG.exe
Token: SeSecurityPrivilege	3728	7zG.exe
Token: SeRestorePrivilege	1376	7zG.exe
Token: 35	1376	7zG.exe
Token: SeSecurityPrivilege	1376	7zG.exe
Token: SeSecurityPrivilege	1376	7zG.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

7zG.exe7zG.exe

pid process

3728 7zG.exe
1376 7zG.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

1260 OpenWith.exe

pid	process
3728	7zG.exe
1376	7zG.exe

pid	process
1260	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Active_Version_Fully_Setups.rar
1⤵
- Modifies registry class
PID:1252

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1260

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1928

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Active_Version_Fully_Setups\" -spe -an -ai#7zMap24673:112:7zEvent8100
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3728

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Active_Version_Fully_Setups\Active_Setups_2023_As_PaSsKey\" -spe -an -ai#7zMap16450:172:7zEvent20003
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1376

C:\Users\Admin\Desktop\Active_Version_Fully_Setups\Active_Setups_2023_As_PaSsKey\Satups.exe
"C:\Users\Admin\Desktop\Active_Version_Fully_Setups\Active_Setups_2023_As_PaSsKey\Satups.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5032

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\Active_Version_Fully_Setups\Active_Setups_2023_As_PaSsKey.rar
Filesize
12.4MB

MD5
d202535c0f306eb5e9a48e4c485aa43c

SHA1
4edb450cddba3e1d23193d2e410dad523b9628a8

SHA256
fb77a5db32893c770edb5cfe63e6a4c4759f66f3e02399a9b7ef5e5eb9e30770

SHA512
f9d6a39645cc211f837775cf8ad907461dc6ebdb91151e07aadfce4cf3ae858fbd8e533036a2ad9215881100c00d2ddd0e088c5731d5d063e14fd92ff0c16a29

Download Submit
C:\Users\Admin\Desktop\Active_Version_Fully_Setups\Active_Setups_2023_As_PaSsKey\Satups.exe
Filesize
1772.7MB

MD5
e6ba3f3877cd9ffaac15dc36f1236687

SHA1
dc06cd17f6346575018c73f4d33909fe7975d83b

SHA256
f6911a4bc65c9ec2806376d8d5db2cdbef38b02737c5ac496afa96a99a5c7e9e

SHA512
25acf005c09b360df00ddb1a9149a9abf49ee750cb3e697b7ebe39cf136d91e620b20045af180f6c56f5cca856ca733809f8398a7a4983824c246db6f9cbafb9

Download Submit
C:\Users\Admin\Desktop\Active_Version_Fully_Setups\Active_Setups_2023_As_PaSsKey\Satups.exe
Filesize
1772.7MB

MD5
e6ba3f3877cd9ffaac15dc36f1236687

SHA1
dc06cd17f6346575018c73f4d33909fe7975d83b

SHA256
f6911a4bc65c9ec2806376d8d5db2cdbef38b02737c5ac496afa96a99a5c7e9e

SHA512
25acf005c09b360df00ddb1a9149a9abf49ee750cb3e697b7ebe39cf136d91e620b20045af180f6c56f5cca856ca733809f8398a7a4983824c246db6f9cbafb9

Download Submit
memory/5032-144-0x0000000001B70000-0x0000000001B71000-memory.dmp

Filesize
4KB

Download
memory/5032-145-0x0000000000400000-0x0000000001A90000-memory.dmp

Filesize
22.6MB

Download