raccoon | 071e9de15078bb820cb507eb135aed7ea4c4c0d42fe14ae205d20310e0ea89bb

General

Target

a2f979b364f6ac14455079cfb11d9378.exe
Size

32.2MB
MD5

a2f979b364f6ac14455079cfb11d9378
SHA1

92f0e94e67fe3dc8de35f8cd4bf30143047df00f
SHA256

071e9de15078bb820cb507eb135aed7ea4c4c0d42fe14ae205d20310e0ea89bb
SHA512

f2cb77f04ccd36863e4473c38332f4cb426d0876003780f47f803540a07bbf27ddccd1f93a07c16eaa56b1807674762be04aa049daef286ca7a8ee1ccf4fda54
SSDEEP

393216:sV0pJXZqIOOHDvUmv4XOS5s41i7vP06D4sCLzhtxw/4JIvWZ:sV0qIbj8mgXL1i7lDqzhtG/Hg

Score

10^/10

raccoon 74b8b770a65f8e339e8f029b78098a50 stealer

Malware Config

Extracted

Family

raccoon

Botnet

74b8b770a65f8e339e8f029b78098a50

C2

http://89.23.107.239:80/

http://49.13.18.115:80/

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3928-195-0x0000000000400000-0x000000000040F000-memory.dmp	family_raccoon
behavioral2/memory/3928-197-0x0000000000400000-0x000000000040F000-memory.dmp	family_raccoon

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a2f979b364f6ac14455079cfb11d9378.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation	a2f979b364f6ac14455079cfb11d9378.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

a2f979b364f6ac14455079cfb11d9378.exe

description pid process target process

PID 4768 set thread context of 3928 4768 a2f979b364f6ac14455079cfb11d9378.exe cvtres.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 4768 set thread context of 3928	4768	a2f979b364f6ac14455079cfb11d9378.exe	cvtres.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

Processes:

a2f979b364f6ac14455079cfb11d9378.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
4768	a2f979b364f6ac14455079cfb11d9378.exe
3836	powershell.exe
3836	powershell.exe
3880	powershell.exe
3880	powershell.exe
4444	powershell.exe
4444	powershell.exe
4604	powershell.exe
4604	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3836	powershell.exe
Token: SeDebugPrivilege	3880	powershell.exe
Token: SeDebugPrivilege	4444	powershell.exe
Token: SeDebugPrivilege	4604	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

a2f979b364f6ac14455079cfb11d9378.exe

description	pid	process	target process
PID 4768 wrote to memory of 3836	4768	a2f979b364f6ac14455079cfb11d9378.exe	powershell.exe
PID 4768 wrote to memory of 3836	4768	a2f979b364f6ac14455079cfb11d9378.exe	powershell.exe
PID 4768 wrote to memory of 3880	4768	a2f979b364f6ac14455079cfb11d9378.exe	powershell.exe
PID 4768 wrote to memory of 3880	4768	a2f979b364f6ac14455079cfb11d9378.exe	powershell.exe
PID 4768 wrote to memory of 3928	4768	a2f979b364f6ac14455079cfb11d9378.exe	cvtres.exe
PID 4768 wrote to memory of 3928	4768	a2f979b364f6ac14455079cfb11d9378.exe	cvtres.exe
PID 4768 wrote to memory of 3928	4768	a2f979b364f6ac14455079cfb11d9378.exe	cvtres.exe
PID 4768 wrote to memory of 4444	4768	a2f979b364f6ac14455079cfb11d9378.exe	powershell.exe
PID 4768 wrote to memory of 4444	4768	a2f979b364f6ac14455079cfb11d9378.exe	powershell.exe
PID 4768 wrote to memory of 3928	4768	a2f979b364f6ac14455079cfb11d9378.exe	cvtres.exe
PID 4768 wrote to memory of 3928	4768	a2f979b364f6ac14455079cfb11d9378.exe	cvtres.exe
PID 4768 wrote to memory of 3928	4768	a2f979b364f6ac14455079cfb11d9378.exe	cvtres.exe
PID 4768 wrote to memory of 3928	4768	a2f979b364f6ac14455079cfb11d9378.exe	cvtres.exe
PID 4768 wrote to memory of 3928	4768	a2f979b364f6ac14455079cfb11d9378.exe	cvtres.exe
PID 4768 wrote to memory of 4604	4768	a2f979b364f6ac14455079cfb11d9378.exe	powershell.exe
PID 4768 wrote to memory of 4604	4768	a2f979b364f6ac14455079cfb11d9378.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\a2f979b364f6ac14455079cfb11d9378.exe
"C:\Users\Admin\AppData\Local\Temp\a2f979b364f6ac14455079cfb11d9378.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMwA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAIgAgAC0ARgBvAHIAYwBlAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
  2⤵
  PID:3928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAANQA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMwAwADAA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
1bad2704664b4c1a190586ec492be65f

SHA1
1c98e6645c66774152c184d23f7a3178ce522e7b

SHA256
5950586396814b38bfdbb86757839fc8c7ce3eb73577775473c29ce6be81fe3e

SHA512
668553c12f1e5560baba826d5c8b139d7c7e323b6aa4e3723aaca479850f898c147d63cb77d305d715044db1e75cf501d6502ca214c7ed05ded424b230893bb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6f32f8ed1eaead20a7e42dfdb7c861ec

SHA1
3e7c461b067fda76d300f7a19c8ac34ab6071b94

SHA256
2618666dfea775d672e00d56a216d5ad04d3c3a0e6da9f06d770ca8bb87aeab4

SHA512
ead7cd93a013a4e32b8ffb607cc2260eb76bfbc6db9ab4bcd92d5d9010726f0561fcd0127cd54da54efb2bff88c8a01b941daf0fe1f56dcf12e91f20856a5528

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e4u2brdk.jcf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3836-159-0x00007FFDBF7F0000-0x00007FFDC02B1000-memory.dmp

Filesize
10.8MB

Download
memory/3836-155-0x000001D4E2860000-0x000001D4E2870000-memory.dmp

Filesize
64KB

Download
memory/3836-154-0x000001D4E2860000-0x000001D4E2870000-memory.dmp

Filesize
64KB

Download
memory/3836-152-0x00007FFDBF7F0000-0x00007FFDC02B1000-memory.dmp

Filesize
10.8MB

Download
memory/3836-142-0x000001D4E27A0000-0x000001D4E27C2000-memory.dmp

Filesize
136KB

Download
memory/3880-162-0x000001B37E400000-0x000001B37E410000-memory.dmp

Filesize
64KB

Download
memory/3880-174-0x000001B37E400000-0x000001B37E410000-memory.dmp

Filesize
64KB

Download
memory/3880-163-0x000001B37E400000-0x000001B37E410000-memory.dmp

Filesize
64KB

Download
memory/3880-176-0x00007FFDBF7F0000-0x00007FFDC02B1000-memory.dmp

Filesize
10.8MB

Download
memory/3880-161-0x00007FFDBF7F0000-0x00007FFDC02B1000-memory.dmp

Filesize
10.8MB

Download
memory/3928-195-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/3928-197-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4444-187-0x00007FFDBF7F0000-0x00007FFDC02B1000-memory.dmp

Filesize
10.8MB

Download
memory/4444-188-0x000001E29E000000-0x000001E29E010000-memory.dmp

Filesize
64KB

Download
memory/4444-194-0x00007FFDBF7F0000-0x00007FFDC02B1000-memory.dmp

Filesize
10.8MB

Download
memory/4444-191-0x000001E29E000000-0x000001E29E010000-memory.dmp

Filesize
64KB

Download
memory/4444-189-0x000001E29E000000-0x000001E29E010000-memory.dmp

Filesize
64KB

Download
memory/4604-210-0x00007FFDBF7F0000-0x00007FFDC02B1000-memory.dmp

Filesize
10.8MB

Download
memory/4604-207-0x00007FFDBF7F0000-0x00007FFDC02B1000-memory.dmp

Filesize
10.8MB

Download
memory/4768-139-0x00007FFDDBF00000-0x00007FFDDBF02000-memory.dmp

Filesize
8KB

Download
memory/4768-134-0x00007FFDDE720000-0x00007FFDDE722000-memory.dmp

Filesize
8KB

Download
memory/4768-137-0x00007FFDDD150000-0x00007FFDDD152000-memory.dmp

Filesize
8KB

Download
memory/4768-138-0x00007FFDDD160000-0x00007FFDDD162000-memory.dmp

Filesize
8KB

Download
memory/4768-156-0x0000016D5DDC0000-0x0000016D5DE0E000-memory.dmp

Filesize
312KB

Download
memory/4768-140-0x00007FFDDBF10000-0x00007FFDDBF12000-memory.dmp

Filesize
8KB

Download
memory/4768-136-0x00007FF627390000-0x00007FF6293C3000-memory.dmp

Filesize
32.2MB

Download
memory/4768-135-0x00007FFDDE730000-0x00007FFDDE732000-memory.dmp

Filesize
8KB

Download
memory/4768-141-0x00007FF627390000-0x00007FF6293C3000-memory.dmp

Filesize
32.2MB

Download
memory/4768-133-0x00007FFDDE710000-0x00007FFDDE712000-memory.dmp

Filesize
8KB

Download
memory/4768-153-0x00007FF627390000-0x00007FF6293C3000-memory.dmp

Filesize
32.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads