Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
01/02/2024, 03:49
General
- Target 85d9f56d801e415f5f6db447a179ae7c.exe
- Size 11.0MB
- Sample240201-edtwbacfam
- SHA256 2301a78ac49dc9fd867992c2402ec8cac8f649955bfcc34f7fe8d9f0f4b4ff5b
Malware Config
Signatures
- Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
- Raccoon Stealer V1 payload 8 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 4 IoCs
- Themida packer 11 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 36 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\85d9f56d801e415f5f6db447a179ae7c.exe"C:\Users\Admin\AppData\Local\Temp\85d9f56d801e415f5f6db447a179ae7c.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Avira Phantom VPN 2.37.3.21018.Svc_xR0E5.exe"C:\ProgramData\Avira Phantom VPN 2.37.3.21018.Svc_xR0E5.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\ProgramData\Avira Phantom VPN 2.37.3.21018_MkaOe.exe"C:\ProgramData\Avira Phantom VPN 2.37.3.21018_MkaOe.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-RBUKG.tmp\Avira Phantom VPN 2.37.3.21018_MkaOe.tmp"C:\Users\Admin\AppData\Local\Temp\is-RBUKG.tmp\Avira Phantom VPN 2.37.3.21018_MkaOe.tmp" /SL5="$11004E,8575473,64512,C:\ProgramData\Avira Phantom VPN 2.37.3.21018_MkaOe.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exe"net" stop "AviraPhantomVPN"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "AviraPhantomVPN"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Avira Phantom VPN 2.37.3.21018_MkaOe.exe
Avira Phantom VPN 2.37.3.21018_MkaOe.exe
Avira Phantom VPN 2.37.3.21018_MkaOe.exe
aut4B70.tmp
ISTask.dll
VclStylesInno.dll
VclStylesInno.dll
Avira Phantom VPN 2.37.3.21018_MkaOe.tmp
Avira Phantom VPN 2.37.3.21018_MkaOe.tmp
memory/1088-20-0x00000000001F0000-0x00000000006DF000-memory.dmp
memory/1088-38-0x00000000001F0000-0x00000000006DF000-memory.dmp
memory/1088-40-0x00000000001F0000-0x00000000006DF000-memory.dmp
memory/1088-37-0x00000000001F0000-0x00000000006DF000-memory.dmp
memory/1088-31-0x00000000001F0000-0x00000000006DF000-memory.dmp
memory/1088-28-0x00000000001F0000-0x00000000006DF000-memory.dmp
memory/1088-21-0x00000000001F0000-0x00000000006DF000-memory.dmp
memory/1088-140-0x00000000001F0000-0x00000000006DF000-memory.dmp
memory/1088-19-0x00000000001F0000-0x00000000006DF000-memory.dmp
memory/1088-18-0x0000000077274000-0x0000000077276000-memory.dmp
memory/1088-17-0x00000000001F0000-0x00000000006DF000-memory.dmp
memory/1120-43-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1120-141-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1868-86-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-119-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-77-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-78-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-79-0x0000000007980000-0x0000000007981000-memory.dmp
memory/1868-81-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-80-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-76-0x0000000007970000-0x0000000007971000-memory.dmp
memory/1868-73-0x0000000007960000-0x0000000007961000-memory.dmp
memory/1868-72-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-71-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-70-0x0000000007950000-0x0000000007951000-memory.dmp
memory/1868-83-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-84-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-85-0x00000000079A0000-0x00000000079A1000-memory.dmp
memory/1868-82-0x0000000007990000-0x0000000007991000-memory.dmp
memory/1868-75-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-87-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-60-0x00000000072C0000-0x00000000072D6000-memory.dmp
memory/1868-92-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-99-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-102-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-101-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-100-0x00000000079F0000-0x00000000079F1000-memory.dmp
memory/1868-107-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-112-0x0000000007A30000-0x0000000007A31000-memory.dmp
memory/1868-118-0x0000000007A50000-0x0000000007A51000-memory.dmp
memory/1868-121-0x0000000007A60000-0x0000000007A61000-memory.dmp
memory/1868-120-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-74-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-117-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-116-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-115-0x0000000007A40000-0x0000000007A41000-memory.dmp
memory/1868-114-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-113-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-111-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-110-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-109-0x0000000007A20000-0x0000000007A21000-memory.dmp
memory/1868-108-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-106-0x0000000007A10000-0x0000000007A11000-memory.dmp
memory/1868-105-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-132-0x00000000072B0000-0x00000000072B1000-memory.dmp
memory/1868-103-0x0000000007A00000-0x0000000007A01000-memory.dmp
memory/1868-104-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-98-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-97-0x00000000079E0000-0x00000000079E1000-memory.dmp
memory/1868-96-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-95-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-94-0x00000000079D0000-0x00000000079D1000-memory.dmp
memory/1868-93-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-91-0x00000000079C0000-0x00000000079C1000-memory.dmp
memory/1868-90-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-89-0x0000000007810000-0x0000000007950000-memory.dmp
memory/1868-88-0x00000000079B0000-0x00000000079B1000-memory.dmp
memory/1868-67-0x00000000074F0000-0x000000000780A000-memory.dmp
memory/1868-52-0x00000000022A0000-0x00000000022A1000-memory.dmp
memory/1868-147-0x00000000022A0000-0x00000000022A1000-memory.dmp
memory/1868-148-0x00000000072B0000-0x00000000072B1000-memory.dmp