Analysis

  • max time kernel
    141s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-04-2023 14:16

General

  • Target

    readerdc64_en_ka_cra_mdr_install.exe

  • Size

    1.3MB

  • MD5

    2a28b875cdc2f3eae4871c4732854f22

  • SHA1

    c31dfe79e224c6726b2f250fbfecda792aa4cb56

  • SHA256

    95c5947e021a773ce1cfd4e774fe69d7a50bad31810cdddd7b72fd1a2a3cf617

  • SHA512

    d29fa59790c61c2c161b124fd43bf874ea4b99c86511d1b169b10d7301710107771a45c36a334f3093db0e891f687b12c74ff22e7d4605f039f738ebc6a5cb04

  • SSDEEP

    24576:slv110ltOoV5/Bh7uVIjpQOyTOD0YHqI61tPd6ew7KRualKIYwR5UlgsmxLSkNR6:WvXyOYp9QOORI6fPd6ew7O7YwR5JwkNY

Score
10/10

Malware Config

Extracted

Family

raccoon

rc4.plain

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\readerdc64_en_ka_cra_mdr_install.exe
    "C:\Users\Admin\AppData\Local\Temp\readerdc64_en_ka_cra_mdr_install.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4628
    • C:\Users\Admin\AppData\Local\Adobe\6B62E2CE-AD8D-4A71-AB5B-0F8F6F8C88EE\1F4BE605-D302-4474-9753-4644A3EFD97B\63F83B80-2F61-4AB0-9340-51587F7FD1EF
      "C:\Users\Admin\AppData\Local\Adobe\6B62E2CE-AD8D-4A71-AB5B-0F8F6F8C88EE\1F4BE605-D302-4474-9753-4644A3EFD97B\63F83B80-2F61-4AB0-9340-51587F7FD1EF" /sAll /re /msi PRODUCT_SOURCE=ACDC OWNERSHIP_STATE=1 UPDATE_MODE=3 EULA_ACCEPT=YES ENABLE_CHROMEEXT=1
      2⤵
      • Executes dropped EXE
      PID:4596

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Adobe\6B62E2CE-AD8D-4A71-AB5B-0F8F6F8C88EE\1F4BE605-D302-4474-9753-4644A3EFD97B\63F83B80-2F61-4AB0-9340-51587F7FD1EF

    Filesize

    336.1MB

    MD5

    a80a64abb71ab775ab393e6b30ca45b1

    SHA1

    f93f67451767c54a8a19fd0e008688d1ea257db3

    SHA256

    7e9167c98629247b3333098954eb34a44d80320bddccbc07972f12674e931f48

    SHA512

    588c8e2842fd7a41e47e91519c2f861fde2a8375086f30227b25c02ef9ffab061fef128fb83431274b5dddaa5acd7c30ade526cff57f26230641c554156c220c

  • C:\Users\Admin\AppData\Local\Adobe\6B62E2CE-AD8D-4A71-AB5B-0F8F6F8C88EE\progressbar_blue_active_100.png

    Filesize

    14KB

    MD5

    bb94a177f10bf764d11f94d24a5db5aa

    SHA1

    6864b58952b19248f4c5ea5c8764c52e207268a7

    SHA256

    caafea31074ba909ec57c9dcdd1b1c0256e5626939cc768b8a041fe42762e230

    SHA512

    d2875eb5ad9ff76ff233ada04fa77aecdbb0c9a80bcd85b0c50087786b47e97feec189d18164e15784cd96850849ee4e1920d7d98157ca7ad317ba03e8c66111

  • memory/4628-136-0x0000000000E00000-0x00000000011F6000-memory.dmp

    Filesize

    4.0MB

  • memory/4628-204-0x0000000000E00000-0x00000000011F6000-memory.dmp

    Filesize

    4.0MB

  • memory/4628-209-0x0000000000E00000-0x00000000011F6000-memory.dmp

    Filesize

    4.0MB

  • memory/4628-210-0x0000000000E00000-0x00000000011F6000-memory.dmp

    Filesize

    4.0MB

  • memory/4628-217-0x0000000000E00000-0x00000000011F6000-memory.dmp

    Filesize

    4.0MB

  • memory/4628-223-0x0000000000E00000-0x00000000011F6000-memory.dmp

    Filesize

    4.0MB

  • memory/4628-236-0x0000000000E00000-0x00000000011F6000-memory.dmp

    Filesize

    4.0MB