Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/02/2024, 03:49

General

  • Target

    85d9f56d801e415f5f6db447a179ae7c.exe

  • Size

    11.0MB

  • MD5

    85d9f56d801e415f5f6db447a179ae7c

  • SHA1

    72cc47e4f0f95e81f4256e026b9fcec5c81c3aea

  • SHA256

    2301a78ac49dc9fd867992c2402ec8cac8f649955bfcc34f7fe8d9f0f4b4ff5b

  • SHA512

    c134d344b0ab273bbfb19431ee829772df64368aca507429a45450d13d6bf52605ab8fef665819075e9b82fd9f5418c7a0ee2dcc9eef88937d613199dfbb9793

  • SSDEEP

    196608:X5Z15/as0Rv8tY0hZm59VjeUZot30BJNCL98OzuZFm0IVu17+2CKj2T5zUa:pla3RvOY0zm9Vjdo3wJsr6me7+nbzr

Malware Config

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • Raccoon Stealer V1 payload 8 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Themida packer 11 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\85d9f56d801e415f5f6db447a179ae7c.exe
    "C:\Users\Admin\AppData\Local\Temp\85d9f56d801e415f5f6db447a179ae7c.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3736
    • C:\ProgramData\Avira Phantom VPN 2.37.3.21018.Svc_xR0E5.exe
      "C:\ProgramData\Avira Phantom VPN 2.37.3.21018.Svc_xR0E5.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1088
    • C:\ProgramData\Avira Phantom VPN 2.37.3.21018_MkaOe.exe
      "C:\ProgramData\Avira Phantom VPN 2.37.3.21018_MkaOe.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1120
      • C:\Users\Admin\AppData\Local\Temp\is-RBUKG.tmp\Avira Phantom VPN 2.37.3.21018_MkaOe.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-RBUKG.tmp\Avira Phantom VPN 2.37.3.21018_MkaOe.tmp" /SL5="$11004E,8575473,64512,C:\ProgramData\Avira Phantom VPN 2.37.3.21018_MkaOe.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1868
        • C:\Windows\SysWOW64\net.exe
          "net" stop "AviraPhantomVPN"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2916
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "AviraPhantomVPN"
            5⤵
              PID:1084

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Avira Phantom VPN 2.37.3.21018_MkaOe.exe

      Filesize

      704KB

      MD5

      f38a3c5571cb4959685057a59ecbb196

      SHA1

      b3d206f07102ffcb2df110dcd6aa115cc504009a

      SHA256

      58776f39a5ce939f23d7b0c4de7eb88380dd6c71204cf67c0254ae7805349c06

      SHA512

      790270e607a30f65ddb18c77901b1921de0da10859a413fd24dc80e91dd678f33214d2da6081385a3ae57472eeaf25976fe26748af7ae57237b7282de9e83814

    • C:\ProgramData\Avira Phantom VPN 2.37.3.21018_MkaOe.exe

      Filesize

      638KB

      MD5

      1bf07b78d43b0ead52e2b2353a0e350e

      SHA1

      2317e146b9de2a10187bc0168306bd99eedf452f

      SHA256

      3d4744a7b6ad9133769e09eb3ea23788452e9690ac88167ddaa87bf4487d0d3e

      SHA512

      7fed8472f6fef87d2be5f374c145c437c44077ed033c9d8bc45f85895670d86aa1d0d57a038a741bf9043c8f2fd8daf79e970ff7592863c6bc929e5e435f4b90

    • C:\ProgramData\Avira Phantom VPN 2.37.3.21018_MkaOe.exe

      Filesize

      530KB

      MD5

      d27474b15e347a299215fb1f2d64c9ad

      SHA1

      f90cfa6e98427bb6fcde3c80b34fccb691a711a0

      SHA256

      9821594292bb165c2a26b5ed66abe35a96cc41253dcac3eb6026eba8a7ab8bd0

      SHA512

      c1e24062c2b7f5aa88674432248e0519c3f861aea68cb62102b6613b6a32159a8d335d18901864ffd25e9017c5027aca06647178f1b03f2cbf1be79a88005cf6

    • C:\Users\Admin\AppData\Local\Temp\aut4B70.tmp

      Filesize

      1.7MB

      MD5

      10a3bc719f4991dd390597b84c7c1883

      SHA1

      c22028d1092dab7ed0984b77c83482e38c48ccbb

      SHA256

      674ac1d007d0e5bb5973ca266cfc9bc5d873994372fff791f01da36879842818

      SHA512

      551e99404b5c11926cc1cf29def69778b43b829a297a027e2b335144e896e5a78e985a62546554a2b618bc13d267195713bb0651f00baca8454e181d6f657ad9

    • C:\Users\Admin\AppData\Local\Temp\is-82QVM.tmp\ISTask.dll

      Filesize

      66KB

      MD5

      86a1311d51c00b278cb7f27796ea442e

      SHA1

      ac08ac9d08f8f5380e2a9a65f4117862aa861a19

      SHA256

      e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d

      SHA512

      129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec

    • C:\Users\Admin\AppData\Local\Temp\is-82QVM.tmp\VclStylesInno.dll

      Filesize

      339KB

      MD5

      74f332ede4a4b3524fd56a6e70d6c857

      SHA1

      af51e10d455e0f1d7ecb036d996bfc35ad06d65b

      SHA256

      6053e41c0ec49e97c09fa322af6c200df3b93e7c01fcd5435f286b5fdd3ae651

      SHA512

      a2a93c23e1d437f19017ce69d7a6a6f4e3713ecf7cd92f06b7ba3a439eb1a77e4ba2c8cc2928decce223664b2954fb94f1e64877228975423ebd706a9391aab9

    • C:\Users\Admin\AppData\Local\Temp\is-82QVM.tmp\VclStylesInno.dll

      Filesize

      225KB

      MD5

      8087a5b88714afcd25ccbcf68cbccf6e

      SHA1

      da3bce14741b55b10d3f67753e7e0ce1e7d05c38

      SHA256

      7d75b75b6a6cc3ce02ecee9b27780fd586a985c367f1a100fd2ebad63e5d36c6

      SHA512

      5d1c234c21a35e50af05288b3a4e7f057c27da616ffcfedae71c1d5062ca6ef232dabb221f028941f3ccd8a0cfbb3ac87daa69d0ee4ccfceac7c2bf16dfe7a2c

    • C:\Users\Admin\AppData\Local\Temp\is-RBUKG.tmp\Avira Phantom VPN 2.37.3.21018_MkaOe.tmp

      Filesize

      507KB

      MD5

      69a5fdb213b1894feb501fd456b4e6c1

      SHA1

      25cd17a35611fb18aa24a6961890150fa33b97a3

      SHA256

      632ab2def68eae6a09e8c9d2058f9da6be7a1aa136e7f48bc5450b9a16d80882

      SHA512

      42c83ea1d0e34abec88674062fc7f4b8523e1fa3c31437daf66b752c42e807ee39e7580a6c5cf04c9fb8420b5da969321c228301d6b8eeb904661baf30475263

    • C:\Users\Admin\AppData\Local\Temp\is-RBUKG.tmp\Avira Phantom VPN 2.37.3.21018_MkaOe.tmp

      Filesize

      440KB

      MD5

      213ce408d1230a5618f456749863d051

      SHA1

      99058bed73639d6b0d8499cec23f714b6dd8184e

      SHA256

      e49c5e435783767063e879222181ba559010fd6921aedde24f35a3642b5b6f8f

      SHA512

      c0ca0299c2853f3fb8b6c8e3b03fd60bfe50bce09e5453fe659d54f10839e0f5274b74506752803df3677f3464f846a067650441e2514feb412f7cc0e027754b

    • memory/1088-20-0x00000000001F0000-0x00000000006DF000-memory.dmp

      Filesize

      4.9MB

    • memory/1088-38-0x00000000001F0000-0x00000000006DF000-memory.dmp

      Filesize

      4.9MB

    • memory/1088-40-0x00000000001F0000-0x00000000006DF000-memory.dmp

      Filesize

      4.9MB

    • memory/1088-37-0x00000000001F0000-0x00000000006DF000-memory.dmp

      Filesize

      4.9MB

    • memory/1088-31-0x00000000001F0000-0x00000000006DF000-memory.dmp

      Filesize

      4.9MB

    • memory/1088-28-0x00000000001F0000-0x00000000006DF000-memory.dmp

      Filesize

      4.9MB

    • memory/1088-21-0x00000000001F0000-0x00000000006DF000-memory.dmp

      Filesize

      4.9MB

    • memory/1088-140-0x00000000001F0000-0x00000000006DF000-memory.dmp

      Filesize

      4.9MB

    • memory/1088-19-0x00000000001F0000-0x00000000006DF000-memory.dmp

      Filesize

      4.9MB

    • memory/1088-18-0x0000000077274000-0x0000000077276000-memory.dmp

      Filesize

      8KB

    • memory/1088-17-0x00000000001F0000-0x00000000006DF000-memory.dmp

      Filesize

      4.9MB

    • memory/1120-43-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB

    • memory/1120-141-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB

    • memory/1868-86-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-119-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-77-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-78-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-79-0x0000000007980000-0x0000000007981000-memory.dmp

      Filesize

      4KB

    • memory/1868-81-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-80-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-76-0x0000000007970000-0x0000000007971000-memory.dmp

      Filesize

      4KB

    • memory/1868-73-0x0000000007960000-0x0000000007961000-memory.dmp

      Filesize

      4KB

    • memory/1868-72-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-71-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-70-0x0000000007950000-0x0000000007951000-memory.dmp

      Filesize

      4KB

    • memory/1868-83-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-84-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-85-0x00000000079A0000-0x00000000079A1000-memory.dmp

      Filesize

      4KB

    • memory/1868-82-0x0000000007990000-0x0000000007991000-memory.dmp

      Filesize

      4KB

    • memory/1868-75-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-87-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-60-0x00000000072C0000-0x00000000072D6000-memory.dmp

      Filesize

      88KB

    • memory/1868-92-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-99-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-102-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-101-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-100-0x00000000079F0000-0x00000000079F1000-memory.dmp

      Filesize

      4KB

    • memory/1868-107-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-112-0x0000000007A30000-0x0000000007A31000-memory.dmp

      Filesize

      4KB

    • memory/1868-118-0x0000000007A50000-0x0000000007A51000-memory.dmp

      Filesize

      4KB

    • memory/1868-121-0x0000000007A60000-0x0000000007A61000-memory.dmp

      Filesize

      4KB

    • memory/1868-120-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-74-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-117-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-116-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-115-0x0000000007A40000-0x0000000007A41000-memory.dmp

      Filesize

      4KB

    • memory/1868-114-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-113-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-111-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-110-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-109-0x0000000007A20000-0x0000000007A21000-memory.dmp

      Filesize

      4KB

    • memory/1868-108-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-106-0x0000000007A10000-0x0000000007A11000-memory.dmp

      Filesize

      4KB

    • memory/1868-105-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-132-0x00000000072B0000-0x00000000072B1000-memory.dmp

      Filesize

      4KB

    • memory/1868-103-0x0000000007A00000-0x0000000007A01000-memory.dmp

      Filesize

      4KB

    • memory/1868-104-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-98-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-97-0x00000000079E0000-0x00000000079E1000-memory.dmp

      Filesize

      4KB

    • memory/1868-96-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-95-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-94-0x00000000079D0000-0x00000000079D1000-memory.dmp

      Filesize

      4KB

    • memory/1868-93-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-91-0x00000000079C0000-0x00000000079C1000-memory.dmp

      Filesize

      4KB

    • memory/1868-90-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-89-0x0000000007810000-0x0000000007950000-memory.dmp

      Filesize

      1.2MB

    • memory/1868-88-0x00000000079B0000-0x00000000079B1000-memory.dmp

      Filesize

      4KB

    • memory/1868-67-0x00000000074F0000-0x000000000780A000-memory.dmp

      Filesize

      3.1MB

    • memory/1868-52-0x00000000022A0000-0x00000000022A1000-memory.dmp

      Filesize

      4KB

    • memory/1868-147-0x00000000022A0000-0x00000000022A1000-memory.dmp

      Filesize

      4KB

    • memory/1868-148-0x00000000072B0000-0x00000000072B1000-memory.dmp

      Filesize

      4KB