raccoon | 61c92c28313919a275926dccfb619e6d7a5b0ddc58cb9a532b6fce2a866b7c15

General

Target

PassKey_55551_CompleteSetupV9.rar
Size

14.9MB
MD5

e9fd51eb223866cf2ef2bafc834cb21c
SHA1

023e452807a4d020013b4addc74ec6156527a170
SHA256

61c92c28313919a275926dccfb619e6d7a5b0ddc58cb9a532b6fce2a866b7c15
SHA512

9595142d39638038fcd113ad63ffcbfebde3b82b44f9b2bd7a9030b9d8f750a23daec7384947e5e4282cadbb70d7cfc9e58c615cc868dea747c96fe787368c71
SSDEEP

393216:lUPzaY+vYY1NwrnG5xLceNFsZtUURXSBbhp:l6exn1NwrnG1KvUn

Score

10^/10

raccoon ee2a3d190100b91c20d8bc284238dda6 stealer vmprotect

Malware Config

Extracted

Family

raccoon

Botnet

ee2a3d190100b91c20d8bc284238dda6

C2

http://94.142.138.176/

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Executes dropped EXE 1 IoCs

Processes:

setup.exe

pid process

4136 setup.exe

pid	process
4136	setup.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\PassKey_55551_CompleteSetupV9\SoftwareFile\setup.exe	vmprotect
C:\Users\Admin\Desktop\PassKey_55551_CompleteSetupV9\SoftwareFile\setup.exe	vmprotect
behavioral2/memory/4136-617-0x0000000000400000-0x0000000000DC0000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

setup.exe

pid process

4136 setup.exe
4136 setup.exe
4136 setup.exe
4136 setup.exe

pid	process
4136	setup.exe
4136	setup.exe
4136	setup.exe
4136	setup.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

7zG.exe7zG.exe

description	pid	process
Token: SeRestorePrivilege	4396	7zG.exe
Token: 35	4396	7zG.exe
Token: SeSecurityPrivilege	4396	7zG.exe
Token: SeSecurityPrivilege	4396	7zG.exe
Token: SeRestorePrivilege	3444	7zG.exe
Token: 35	3444	7zG.exe
Token: SeSecurityPrivilege	3444	7zG.exe
Token: SeSecurityPrivilege	3444	7zG.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

7zG.exe7zG.exe

pid process

4396 7zG.exe
3444 7zG.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3564 OpenWith.exe

pid	process
4396	7zG.exe
3444	7zG.exe

pid	process
3564	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PassKey_55551_CompleteSetupV9.rar
1⤵
- Modifies registry class
PID:5080

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3564

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3948

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\PassKey_55551_CompleteSetupV9\" -spe -an -ai#7zMap3766:116:7zEvent20569
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4396

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\PassKey_55551_CompleteSetupV9\SoftwareFile\" -spe -an -ai#7zMap25195:142:7zEvent2108
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3444

C:\Users\Admin\Desktop\PassKey_55551_CompleteSetupV9\SoftwareFile\setup.exe
"C:\Users\Admin\Desktop\PassKey_55551_CompleteSetupV9\SoftwareFile\setup.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4136

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\PassKey_55551_CompleteSetupV9\SoftwareFile.rar
Filesize
14.9MB

MD5
0e51d7200aa6a2ece3b9c263de4dd3d4

SHA1
d60f9613d0b1970724b020c8de56b27639236d35

SHA256
c656c8eb82f761d11745bac3783b4400a178b3d4e8bc25b7447cbf439defafd3

SHA512
07c0e5c3f0484c02585cb0c45bcec498da6f41de87cfeff45a57f8a10dbc2ed1e7551ba554b91331eae223e5e6f4bd3042913d46e4f470cde4bdb7eda98ce4c6

Download Submit
C:\Users\Admin\Desktop\PassKey_55551_CompleteSetupV9\SoftwareFile\setup.exe
Filesize
1190.2MB

MD5
bd70ceadc7da2a573d635390029424fe

SHA1
cdc42f3c6bf3ebee6a1090c535e07a45090b33f4

SHA256
78ecbbf5da44aa120680d595e16db322ecf6b9445f34b344718c95fe6dc03149

SHA512
32193c5de0535b2f75a1ba31a9150ef4f8af2396a26e452c6d377bda4b3301692ed0f32800b5b5589a11a0641b47a8005404a7a5b09437b8e4ae871670791975

Download Submit
C:\Users\Admin\Desktop\PassKey_55551_CompleteSetupV9\SoftwareFile\setup.exe
Filesize
1190.2MB

MD5
bd70ceadc7da2a573d635390029424fe

SHA1
cdc42f3c6bf3ebee6a1090c535e07a45090b33f4

SHA256
78ecbbf5da44aa120680d595e16db322ecf6b9445f34b344718c95fe6dc03149

SHA512
32193c5de0535b2f75a1ba31a9150ef4f8af2396a26e452c6d377bda4b3301692ed0f32800b5b5589a11a0641b47a8005404a7a5b09437b8e4ae871670791975

Download Submit
memory/4136-610-0x0000000000F20000-0x0000000000F21000-memory.dmp

Filesize
4KB

Download
memory/4136-612-0x0000000000F50000-0x0000000000F51000-memory.dmp

Filesize
4KB

Download
memory/4136-615-0x0000000000F90000-0x0000000000F91000-memory.dmp

Filesize
4KB

Download
memory/4136-614-0x0000000000F80000-0x0000000000F81000-memory.dmp

Filesize
4KB

Download
memory/4136-613-0x0000000000F60000-0x0000000000F61000-memory.dmp

Filesize
4KB

Download
memory/4136-611-0x0000000000F30000-0x0000000000F31000-memory.dmp

Filesize
4KB

Download
memory/4136-616-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Filesize
4KB

Download
memory/4136-617-0x0000000000400000-0x0000000000DC0000-memory.dmp

Filesize
9.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads