raccoon | e93c31bd6347a60b99fe45160d1318f36357c268fe950697164e57d5da7af2bd

Resubmissions

21/02/2024, 22:33

240221-2g2fwsgc2s10

21/02/2024, 00:09

240221-afr3aaha9710

16/02/2024, 10:54

240216-mzr8lshf8510

Analysis

max time kernel
445s
max time network
1173s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
21/02/2024, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Internet Download Manager License.exe
Size 802KB
Sample240221-2g2fwsgc2s
SHA256 e93c31bd6347a60b99fe45160d1318f36357c268fe950697164e57d5da7af2bd
MD5 02d2c2abfc8d6251fb6472c22c7d711d
SHA1 3bc0f7eaacd430c751204eaa5724390a23b0df19
SHA512 5c499c114aea07c791760f78960e4273138d16212ebfcfa131bb563e74eff7a19c36f555ce8fd9c3dc230da82d37d114655fae28fd17bd871be0ee32cb5f4ed0
SSDEEP 12288:LBEB6RWvx01Cm/L/4yDD16d5yOonecuAHf6xRa12fhVCdE3BI2l421XsJ98J9e:tzCmT/4I6HFosxagl3B569x
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

raccoon c4568b481c4a7791f7fa306252ab42b8 stealer

Malware Config

Extracted

Family

raccoon

Botnet

c4568b481c4a7791f7fa306252ab42b8

http://195.2.76.141:80/

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/1180-34-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral1/memory/1180-36-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2096 created 3296	2096	Increase.pif	26

Executes dropped EXE 2 IoCs

pid	Process
2096	Increase.pif
1180	Increase.pif

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2096 set thread context of 1180	2096	Increase.pif	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
2260	tasklist.exe
2380	tasklist.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2348	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2096	Increase.pif
2096	Increase.pif
2096	Increase.pif
2096	Increase.pif
2096	Increase.pif
2096	Increase.pif
2096	Increase.pif
2096	Increase.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2260	tasklist.exe
Token: SeDebugPrivilege	2380	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2096	Increase.pif
2096	Increase.pif
2096	Increase.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2096	Increase.pif
2096	Increase.pif
2096	Increase.pif

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 3788	1408	Internet Download Manager License.exe	79
PID 1408 wrote to memory of 3788	1408	Internet Download Manager License.exe	79
PID 1408 wrote to memory of 3788	1408	Internet Download Manager License.exe	79
PID 3788 wrote to memory of 2260	3788	cmd.exe	81
PID 3788 wrote to memory of 2260	3788	cmd.exe	81
PID 3788 wrote to memory of 2260	3788	cmd.exe	81
PID 3788 wrote to memory of 3672	3788	cmd.exe	82
PID 3788 wrote to memory of 3672	3788	cmd.exe	82
PID 3788 wrote to memory of 3672	3788	cmd.exe	82
PID 3788 wrote to memory of 2380	3788	cmd.exe	84
PID 3788 wrote to memory of 2380	3788	cmd.exe	84
PID 3788 wrote to memory of 2380	3788	cmd.exe	84
PID 3788 wrote to memory of 2560	3788	cmd.exe	85
PID 3788 wrote to memory of 2560	3788	cmd.exe	85
PID 3788 wrote to memory of 2560	3788	cmd.exe	85
PID 3788 wrote to memory of 4680	3788	cmd.exe	86
PID 3788 wrote to memory of 4680	3788	cmd.exe	86
PID 3788 wrote to memory of 4680	3788	cmd.exe	86
PID 3788 wrote to memory of 4616	3788	cmd.exe	87
PID 3788 wrote to memory of 4616	3788	cmd.exe	87
PID 3788 wrote to memory of 4616	3788	cmd.exe	87
PID 3788 wrote to memory of 5020	3788	cmd.exe	88
PID 3788 wrote to memory of 5020	3788	cmd.exe	88
PID 3788 wrote to memory of 5020	3788	cmd.exe	88
PID 3788 wrote to memory of 2096	3788	cmd.exe	89
PID 3788 wrote to memory of 2096	3788	cmd.exe	89
PID 3788 wrote to memory of 2096	3788	cmd.exe	89
PID 3788 wrote to memory of 2348	3788	cmd.exe	90
PID 3788 wrote to memory of 2348	3788	cmd.exe	90
PID 3788 wrote to memory of 2348	3788	cmd.exe	90
PID 2096 wrote to memory of 1180	2096	Increase.pif	91
PID 2096 wrote to memory of 1180	2096	Increase.pif	91
PID 2096 wrote to memory of 1180	2096	Increase.pif	91
PID 2096 wrote to memory of 1180	2096	Increase.pif	91
PID 2096 wrote to memory of 1180	2096	Increase.pif	91

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3296
- C:\Users\Admin\AppData\Local\Temp\Internet Download Manager License.exe
  "C:\Users\Admin\AppData\Local\Temp\Internet Download Manager License.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Stanford Stanford.bat & Stanford.bat & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3788
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2260
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      PID:3672
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2380
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      PID:2560
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 17220
      4⤵
      PID:4680
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Tragedy + Report + Coming + Yearly + Frontier + Advertiser 17220\Increase.pif
      4⤵
      PID:4616
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Pharmacy 17220\k
      4⤵
      PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\17220\Increase.pif
      17220\Increase.pif 17220\k
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2096
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 localhost
      4⤵
      Runs ping.exe
      PID:2348
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\17220\Increase.pif
  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\17220\Increase.pif
  2⤵
  - Executes dropped EXE
  PID:1180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Increase.pif

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\17220\Increase.pif
Size 924KB
SHA256 f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
MD5 848164d084384c49937f99d5b894253e
SHA1 3055ef803eeec4f175ebf120f94125717ee12444
SHA512 aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a
SSDEEP 24576:LOo8pEnK4mrqlEZuVZ2HOI+X0l1lMZyYFaeBmyF:LF8p4KpqlEZeXI+X0TVcae3F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Advertiser

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Advertiser
Size 113KB
SHA256 29c97cb8ebc8fd09a2d6dd2584dd7834317b35eac2862a51c46e765921a7e9bf
MD5 4ef8474a649e9eeede013052b00d390d
SHA1 e84d2dc717517b277f4d74f46e93092a24086c17
SHA512 43bdad089989d643545268c2c9bf9e1d565a7d16ec96b7477afb9e9153e41e5ec09905e7a18544ac6f0d3e2c057c2f12a855d2ff6484970693d8f7e5ac643e4e
SSDEEP 1536:1arB3RZg3EYrDWyu0uZo2+9BkxXiblenlJJyIE2UWb/hoQZ2OE3:1arB3RZgDWy4ZNogXJ3i2Umb2Oq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Coming

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Coming
Size 121KB
SHA256 b4746cf5982696d4285e30dd1422db437916902cdd96286c44c10bca4b029270
MD5 22faa5ab1a562c02aa3e9ecc75014736
SHA1 d27ca1a7f3833fdd401cf0b86bac5a1cf9cac0c7
SHA512 733be7bccc8f80dd45a98b85b937a02cfa9c39b2a35f9a132738f74a3ef9ddc7f9b6b434443669cea1f1c8226690755847a6c0f2548c5c3f7c76e4f5ad013887
SSDEEP 3072:OLWysRIO7vHZnBfzHl8Dz5YaZYvlfA6Gfza6iyu:Bb5nZ2tZ6lfA6Gfm66
MD5 SHA1 SHA512 SSDEEP

Submit Download

Frontier

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Frontier
Size 149KB
SHA256 b4253c5c2ded775d79563fcc7700583fe6b42d502cc1e2f391633c4013ed1532
MD5 f281202117b12b3b8f65f1d085081938
SHA1 e7739e6c857ffc7e09281bcc1270ff5e6de7ac02
SHA512 10934aceae953ef815dedf862f3c4a8f3ffb4c33dbbe29baefa21163b9a3d59b44a2f9a061efd489de2e92df3580d66172751244c16c2fc9d51c049cd5c7899c
SSDEEP 1536:+vtmgMbFuz08QuklMBNIi9u5aAwubPdMaj6iTcohiPfKj+wsxjq:4Ag0Fuz08XvBNbIaAtbPf6jKj+wsxjq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pharmacy

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Pharmacy
Size 497KB
SHA256 fd0927fee7fdabcddfc7e2af46d397e2e00b6aa474f80ea6f08de32c220ed2c9
MD5 31a0c3bafc0fd8ded75133795294cfe2
SHA1 212915761f3d130137c4e3a089aedd6b9729e08f
SHA512 f291f50cb84ffe669527ceeff43facfaa910cd7d9c125c3f75f6450059b207f8be844192c8ee529e5b84f034bda01c254521e794657a67bff48417aaa23a892b
SSDEEP 6144:vP/6+vIEFU6ifD+cZ+c4y+rJzgbNmRR6zGQ/Jk/Jcwd9LOPNrvrB3T+nlzL9lUQ:vHXD6wdA1zBj+nlzL9lR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Report

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Report
Size 203KB
SHA256 17e1cee5f3d0bf1fc155e2734051c4a93b3838e1c632de7c51777184830551fa
MD5 d4947d5a74e9ae4074ecaa1e6eef791c
SHA1 1c8ba7ef8c60c3794881853892600cf60ee17374
SHA512 79c598df4603f6a83bebd8470442e088b1f5016bcbaa90fac65a42945108c8293fd79b6e9e145440ea97c42c8290aa73c026a44346cb66bc748dae8fee2d5a9a
SSDEEP 6144:3lrztgwU0Wyw3mFygyE4mqd12lqlEAehuqN8zwNzlmhPLL:3lvSr0Wyw20K4mqClqlEZuBL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Stanford

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Stanford
Size 11KB
SHA256 5848b94d4ef4d734ddb56eb5b4ba0b989f8b04969000b61d0f8b2711c66d7198
MD5 7bd5bf7ffa2e0f8b0c1f10be96658073
SHA1 8e05de54299a7bb8fc15c80b85639ea447d7ebe0
SHA512 954a76448f8e670b9d082053243c5e367bf28635907e34a17e8cb893d4530a06f01d0597b43d690b2834464ec338bdcf4357381b41470fd5cfc51803039146f9
SSDEEP 192:sbpdrDH1JYEOGVJwYagpU0ms8V1V1E17T1aiavqx1Z8Oa1M1aiaL1pwIWsAX2TWx:sdd/fYEOGsYaSU0ms8V1V1E17T1aiavU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tragedy

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tragedy
Size 112KB
SHA256 9da94265772f2a7b287e5aeffaedcf9ecc0d6a90711a6472379880f745ecbc62
MD5 afeff9af5201f9ee74eb24667e9ef5bc
SHA1 e0e2f7394849333b799530573e815410419bff89
SHA512 1ecd6540a8213768f462ebf177b14025fa0c5f6703d534e91a8a7d4c66e3ec9bab3424b0dbd83151fa7d2444956795c4332f53a046214e0d20412d9fb2040c26
SSDEEP 3072:pPpU08BjlWTPJth26X7Sn4UfpLUNN9t68cCs:LQBk7JjX74cNu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Yearly

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Yearly
Size 226KB
SHA256 3705902963134f512745845391924248fc381cd00a2d6753c0fbedfa8e1a7163
MD5 6bc344966496b7c4b01aefd6cb51c0e5
SHA1 a757130fc76f3c296a0693e3e67d3eff3d485682
SHA512 90c1558b02f54403b1565b5a5ba2a989e97997a65cd7b30a770477e81a2ed0318f54b195ab5470758ada0d116ebfd98a1f4d0ea4905db723cf263879f0784bbc
SSDEEP 6144:l8DsvqJX4xNAB+xHFq9O0lHPOGUWLhxjRYmFqZvb:hvqJWNAB+X0lHPOGNnlMZD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1180-33-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/1180-34-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/1180-36-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/2096-30-0x0000000077291000-0x00000000773B3000-memory.dmp

Download

memory/2096-32-0x0000000004A10000-0x0000000004A11000-memory.dmp

Download