raccoon | cfb378f8d902d20bc733c205ee8d7f1e4493da6971400fa0c8515f37001212b9

General

Target

Pre-Activated-Setup.exe
Size

25.6MB
MD5

7f7d50ed8f4a8432a0371c83693e3bdc
SHA1

e2b50df6d0b61f67e0bb7caa6fb444699ee096dc
SHA256

cfb378f8d902d20bc733c205ee8d7f1e4493da6971400fa0c8515f37001212b9
SHA512

322850f8137bf59b0fc5a39c36442bff92cb21cb7ec42be06a05d13bb148ea90a2b3fccc31bf042065ce2bfa7ad16b3c8d422274dc1a3d24eed995e62759a6b5
SSDEEP

393216:hGMbkfWjBPBtR0LUKfS9vXRBKaNF+AWkafU5wl7zAhAHuKv+PSFq9A9/ceW:h+ePXWLBadWaBWHsERHupPar9/c7

Score

10^/10

raccoon 67f7314de84b54b5f21ebf56b4ba37ca stealer

Malware Config

Extracted

Family

raccoon

Botnet

67f7314de84b54b5f21ebf56b4ba37ca

C2

http://79.137.248.173:80/

http://89.208.106.110:80/

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1300-189-0x0000000000400000-0x000000000040F000-memory.dmp	family_raccoon
behavioral1/memory/1300-191-0x0000000000400000-0x000000000040F000-memory.dmp	family_raccoon

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Pre-Activated-Setup.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation	Pre-Activated-Setup.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

Pre-Activated-Setup.exe

description ioc process

File opened (read-only) \??\F: Pre-Activated-Setup.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Pre-Activated-Setup.exe

description pid process target process

PID 2648 set thread context of 1300 2648 Pre-Activated-Setup.exe AddInProcess32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened (read-only)	\??\F:	Pre-Activated-Setup.exe

description	pid	process	target process
PID 2648 set thread context of 1300	2648	Pre-Activated-Setup.exe	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

Pre-Activated-Setup.exepowershell.exepowershell.exepowershell.exe

pid	process
2648	Pre-Activated-Setup.exe
2648	Pre-Activated-Setup.exe
2648	Pre-Activated-Setup.exe
2648	Pre-Activated-Setup.exe
2648	Pre-Activated-Setup.exe
2648	Pre-Activated-Setup.exe
2648	Pre-Activated-Setup.exe
2648	Pre-Activated-Setup.exe
2648	Pre-Activated-Setup.exe
2648	Pre-Activated-Setup.exe
2648	Pre-Activated-Setup.exe
2648	Pre-Activated-Setup.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4512	powershell.exe
4512	powershell.exe
4512	powershell.exe
1364	powershell.exe
1364	powershell.exe
1364	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 4704 powershell.exe
Token: SeDebugPrivilege 4512 powershell.exe
Token: SeDebugPrivilege 1364 powershell.exe

description	pid	process
Token: SeDebugPrivilege	4704	powershell.exe
Token: SeDebugPrivilege	4512	powershell.exe
Token: SeDebugPrivilege	1364	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

Pre-Activated-Setup.exe

description	pid	process	target process
PID 2648 wrote to memory of 4704	2648	Pre-Activated-Setup.exe	powershell.exe
PID 2648 wrote to memory of 4704	2648	Pre-Activated-Setup.exe	powershell.exe
PID 2648 wrote to memory of 5032	2648	Pre-Activated-Setup.exe	AddInProcess32.exe
PID 2648 wrote to memory of 5032	2648	Pre-Activated-Setup.exe	AddInProcess32.exe
PID 2648 wrote to memory of 5032	2648	Pre-Activated-Setup.exe	AddInProcess32.exe
PID 2648 wrote to memory of 4512	2648	Pre-Activated-Setup.exe	powershell.exe
PID 2648 wrote to memory of 4512	2648	Pre-Activated-Setup.exe	powershell.exe
PID 2648 wrote to memory of 1300	2648	Pre-Activated-Setup.exe	AddInProcess32.exe
PID 2648 wrote to memory of 1300	2648	Pre-Activated-Setup.exe	AddInProcess32.exe
PID 2648 wrote to memory of 1300	2648	Pre-Activated-Setup.exe	AddInProcess32.exe
PID 2648 wrote to memory of 1364	2648	Pre-Activated-Setup.exe	powershell.exe
PID 2648 wrote to memory of 1364	2648	Pre-Activated-Setup.exe	powershell.exe
PID 2648 wrote to memory of 1300	2648	Pre-Activated-Setup.exe	AddInProcess32.exe
PID 2648 wrote to memory of 1300	2648	Pre-Activated-Setup.exe	AddInProcess32.exe
PID 2648 wrote to memory of 1300	2648	Pre-Activated-Setup.exe	AddInProcess32.exe
PID 2648 wrote to memory of 1300	2648	Pre-Activated-Setup.exe	AddInProcess32.exe
PID 2648 wrote to memory of 1300	2648	Pre-Activated-Setup.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\Pre-Activated-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Pre-Activated-Setup.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMwA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4704
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:5032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAANAA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4512
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMwA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ae343a0c544713797d1582baed41cd6c

SHA1
170efb0fbebe36a6f605c6cfd664525f1158a58e

SHA256
dbc33d6f061613aaf9ec0a3472b37ec709ac168cde70c7b48c5807765f3ed292

SHA512
68afed158e066e67d6526627ceda320e1702779b95b8fe597ef573c1be7bcef0dc19f0e6fc17e8103c16fb0aa77d83e06e5f64435100d60193e3ee72e9bbc8b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
3db5a3b556b01c59c5812cb86abb674e

SHA1
3848e5419d5c47879f159247e4f1b08005674cf0

SHA256
218d487f881ce9640acd16f7476b445471b83671569e99973f77d0bbf6c42ffa

SHA512
3eb6575d3e476053a65b2631b0cd0d584056ca476058ee2706c69fe10b0502460c40f8985f1f4666e42fba2809924f6dc34ba2e9b2629217542e45cb3640adcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_53ozzisx.sco.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1300-191-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1300-189-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1364-188-0x00007FF8F53E0000-0x00007FF8F5EA1000-memory.dmp

Filesize
10.8MB

Download
memory/1364-185-0x00000264AB290000-0x00000264AB2A0000-memory.dmp

Filesize
64KB

Download
memory/1364-175-0x00007FF8F53E0000-0x00007FF8F5EA1000-memory.dmp

Filesize
10.8MB

Download
memory/2648-151-0x00007FF7667D0000-0x00007FF7691F9000-memory.dmp

Filesize
42.2MB

Download
memory/2648-192-0x00007FF7667D0000-0x00007FF7691F9000-memory.dmp

Filesize
42.2MB

Download
memory/2648-134-0x00007FF7667D0000-0x00007FF7691F9000-memory.dmp

Filesize
42.2MB

Download
memory/2648-135-0x00007FF7667D0000-0x00007FF7691F9000-memory.dmp

Filesize
42.2MB

Download
memory/2648-133-0x00007FF914810000-0x00007FF914812000-memory.dmp

Filesize
8KB

Download
memory/4512-160-0x0000021528830000-0x0000021528840000-memory.dmp

Filesize
64KB

Download
memory/4512-172-0x0000021528830000-0x0000021528840000-memory.dmp

Filesize
64KB

Download
memory/4512-174-0x00007FF8F53E0000-0x00007FF8F5EA1000-memory.dmp

Filesize
10.8MB

Download
memory/4512-161-0x0000021528830000-0x0000021528840000-memory.dmp

Filesize
64KB

Download
memory/4512-159-0x00007FF8F53E0000-0x00007FF8F5EA1000-memory.dmp

Filesize
10.8MB

Download
memory/4704-157-0x00007FF8F52C0000-0x00007FF8F5D81000-memory.dmp

Filesize
10.8MB

Download
memory/4704-154-0x0000019F68290000-0x0000019F682A0000-memory.dmp

Filesize
64KB

Download
memory/4704-153-0x00007FF8F52C0000-0x00007FF8F5D81000-memory.dmp

Filesize
10.8MB

Download
memory/4704-152-0x0000019F68290000-0x0000019F682A0000-memory.dmp

Filesize
64KB

Download
memory/4704-150-0x0000019F681C0000-0x0000019F681E2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads