Analysis

  • max time kernel
    142s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-04-2023 10:15

General

  • Target

    readerdc64_br_ka_cra_mdr_install.exe

  • Size

    1.3MB

  • MD5

    2a28b875cdc2f3eae4871c4732854f22

  • SHA1

    c31dfe79e224c6726b2f250fbfecda792aa4cb56

  • SHA256

    95c5947e021a773ce1cfd4e774fe69d7a50bad31810cdddd7b72fd1a2a3cf617

  • SHA512

    d29fa59790c61c2c161b124fd43bf874ea4b99c86511d1b169b10d7301710107771a45c36a334f3093db0e891f687b12c74ff22e7d4605f039f738ebc6a5cb04

  • SSDEEP

    24576:slv110ltOoV5/Bh7uVIjpQOyTOD0YHqI61tPd6ew7KRualKIYwR5UlgsmxLSkNR6:WvXyOYp9QOORI6fPd6ew7O7YwR5JwkNY

Score
10/10

Malware Config

Extracted

Family

raccoon

rc4.plain

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\readerdc64_br_ka_cra_mdr_install.exe
    "C:\Users\Admin\AppData\Local\Temp\readerdc64_br_ka_cra_mdr_install.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4124
    • C:\Users\Admin\AppData\Local\Adobe\F69E49A5-D71B-45AB-A329-30F55BC6C421\2E16451C-D882-4B12-9A7F-9331B890D2DD\97CCFCC6-5B61-4966-9928-9B6519AACF84
      "C:\Users\Admin\AppData\Local\Adobe\F69E49A5-D71B-45AB-A329-30F55BC6C421\2E16451C-D882-4B12-9A7F-9331B890D2DD\97CCFCC6-5B61-4966-9928-9B6519AACF84" /sAll /re /msi PRODUCT_SOURCE=ACDC OWNERSHIP_STATE=1 UPDATE_MODE=3 EULA_ACCEPT=YES ENABLE_CHROMEEXT=1
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1492

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Adobe\Temp\2301\config.bin

    Filesize

    3KB

    MD5

    f2de816930e2578fe2b37e1e2af5efd4

    SHA1

    73b0e6bf692adb032b503e1786e76b9086540d43

    SHA256

    49f7b0953dd79bb9a649acbda22b1fbe69c7cb3bcd053c2a2a23400a55cb73ed

    SHA512

    159fa977edd0ac314a8d113223a19741b747a9235f04face026c42ddab797fad67e65a323f20d67a6a6beba558117d29b596518503cf7f5c306b378b5d211bcc

  • C:\Users\Admin\AppData\Local\Adobe\F69E49A5-D71B-45AB-A329-30F55BC6C421\2E16451C-D882-4B12-9A7F-9331B890D2DD\97CCFCC6-5B61-4966-9928-9B6519AACF84

    Filesize

    210.9MB

    MD5

    26860566e6d4c8fdfa59f0ae5a63a94e

    SHA1

    03a29fb11e623b62351ba22bfd83b921198226f9

    SHA256

    9795cd44d6fa10acc8af1367f03907fa8a2477e23497fae737a5919903f38e01

    SHA512

    2fa89335cc2aad5c67b7a728d968293bf80514b30cef32e2a29eb60a17ac5b09e717273b642d90d1d327554d874541df05ae3c262a62264f2d28d6858b226989

  • C:\Users\Admin\AppData\Local\Adobe\F69E49A5-D71B-45AB-A329-30F55BC6C421\2E16451C-D882-4B12-9A7F-9331B890D2DD\97CCFCC6-5B61-4966-9928-9B6519AACF84

    Filesize

    211.2MB

    MD5

    2d55df18e78fa5ec038c062988503e75

    SHA1

    c87ed104003fc74160590de6f63040eb028145ea

    SHA256

    8c51c599aeb0f3140f5aa7faf5f31efd279fcd7fa9372b2477efae9441a5e35c

    SHA512

    fdce307e962159ccd8169c9b42d3df7926d4c61ee8e273c9f64118c082649a7ba366debef0991a37f36c013d914fbc11db4dc95b0b865a151143fcfd18cb34ee

  • C:\Users\Admin\AppData\Local\Adobe\F69E49A5-D71B-45AB-A329-30F55BC6C421\progressbar_blue_active_100.png

    Filesize

    14KB

    MD5

    bb94a177f10bf764d11f94d24a5db5aa

    SHA1

    6864b58952b19248f4c5ea5c8764c52e207268a7

    SHA256

    caafea31074ba909ec57c9dcdd1b1c0256e5626939cc768b8a041fe42762e230

    SHA512

    d2875eb5ad9ff76ff233ada04fa77aecdbb0c9a80bcd85b0c50087786b47e97feec189d18164e15784cd96850849ee4e1920d7d98157ca7ad317ba03e8c66111

  • memory/4124-133-0x0000000000B30000-0x0000000000F26000-memory.dmp

    Filesize

    4.0MB

  • memory/4124-204-0x0000000000B30000-0x0000000000F26000-memory.dmp

    Filesize

    4.0MB

  • memory/4124-209-0x0000000000B30000-0x0000000000F26000-memory.dmp

    Filesize

    4.0MB

  • memory/4124-215-0x0000000000B30000-0x0000000000F26000-memory.dmp

    Filesize

    4.0MB

  • memory/4124-224-0x0000000000B30000-0x0000000000F26000-memory.dmp

    Filesize

    4.0MB

  • memory/4124-238-0x0000000000B30000-0x0000000000F26000-memory.dmp

    Filesize

    4.0MB