raccoon | 8ac262e42dc9b061481f38467e202f22271f204cf595b610eb0ad4f5bbcd560b

Analysis

max time kernel
94s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 14:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
F4D52951FC8094515A9E103892247E8E.exe
Size 819KB
Sample240223-rw14kabb27
SHA256 8ac262e42dc9b061481f38467e202f22271f204cf595b610eb0ad4f5bbcd560b
MD5 f4d52951fc8094515a9e103892247e8e
SHA1 5e7ac04c02e77a06412c6f46e1266d74543a2e20
SHA512 e5a18bb1e3263bde346c285b3736981f4caff784037e693e286fe771d2fb01fbe12a84bc93772894a1de523fc6d1433d1612309f14a27ea93eeac07b62974f4a
SSDEEP 12288:hX9RHpKhSBauYX8z4FESjS4UOx6YgwiJ2mYKdp2hFZTysoKVbJBdXzKv5CfaemkE:ous8z4jVUOJgwk2sp12bdhmkJ3EZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

raccoon 533dd9c84bccbd9ddf7f34e6cd42ad4e stealer

Malware Config

Extracted

Family

raccoon

Botnet

533dd9c84bccbd9ddf7f34e6cd42ad4e

http://178.20.43.58:80/

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 2 IoCs

resource	yara_rule
behavioral2/memory/4040-33-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/4040-35-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 548 created 3444	548	Mariah.pif	43

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2132103209-3755304320-2959162027-1000\Control Panel\International\Geo\Nation	F4D52951FC8094515A9E103892247E8E.exe

Executes dropped EXE 2 IoCs

pid	Process
548	Mariah.pif
4040	Mariah.pif

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 548 set thread context of 4040	548	Mariah.pif	106

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
5064	tasklist.exe
3552	tasklist.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
6112	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
548	Mariah.pif
548	Mariah.pif
548	Mariah.pif
548	Mariah.pif
548	Mariah.pif
548	Mariah.pif
548	Mariah.pif
548	Mariah.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5064	tasklist.exe
Token: SeDebugPrivilege	3552	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
548	Mariah.pif
548	Mariah.pif
548	Mariah.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
548	Mariah.pif
548	Mariah.pif
548	Mariah.pif

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 5616	4848	F4D52951FC8094515A9E103892247E8E.exe	91
PID 4848 wrote to memory of 5616	4848	F4D52951FC8094515A9E103892247E8E.exe	91
PID 4848 wrote to memory of 5616	4848	F4D52951FC8094515A9E103892247E8E.exe	91
PID 5616 wrote to memory of 5064	5616	cmd.exe	94
PID 5616 wrote to memory of 5064	5616	cmd.exe	94
PID 5616 wrote to memory of 5064	5616	cmd.exe	94
PID 5616 wrote to memory of 5056	5616	cmd.exe	95
PID 5616 wrote to memory of 5056	5616	cmd.exe	95
PID 5616 wrote to memory of 5056	5616	cmd.exe	95
PID 5616 wrote to memory of 3552	5616	cmd.exe	97
PID 5616 wrote to memory of 3552	5616	cmd.exe	97
PID 5616 wrote to memory of 3552	5616	cmd.exe	97
PID 5616 wrote to memory of 4436	5616	cmd.exe	98
PID 5616 wrote to memory of 4436	5616	cmd.exe	98
PID 5616 wrote to memory of 4436	5616	cmd.exe	98
PID 5616 wrote to memory of 2900	5616	cmd.exe	99
PID 5616 wrote to memory of 2900	5616	cmd.exe	99
PID 5616 wrote to memory of 2900	5616	cmd.exe	99
PID 5616 wrote to memory of 6128	5616	cmd.exe	100
PID 5616 wrote to memory of 6128	5616	cmd.exe	100
PID 5616 wrote to memory of 6128	5616	cmd.exe	100
PID 5616 wrote to memory of 5076	5616	cmd.exe	101
PID 5616 wrote to memory of 5076	5616	cmd.exe	101
PID 5616 wrote to memory of 5076	5616	cmd.exe	101
PID 5616 wrote to memory of 548	5616	cmd.exe	102
PID 5616 wrote to memory of 548	5616	cmd.exe	102
PID 5616 wrote to memory of 548	5616	cmd.exe	102
PID 5616 wrote to memory of 6112	5616	cmd.exe	103
PID 5616 wrote to memory of 6112	5616	cmd.exe	103
PID 5616 wrote to memory of 6112	5616	cmd.exe	103
PID 548 wrote to memory of 4040	548	Mariah.pif	106
PID 548 wrote to memory of 4040	548	Mariah.pif	106
PID 548 wrote to memory of 4040	548	Mariah.pif	106
PID 548 wrote to memory of 4040	548	Mariah.pif	106
PID 548 wrote to memory of 4040	548	Mariah.pif	106

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3444
- C:\Users\Admin\AppData\Local\Temp\F4D52951FC8094515A9E103892247E8E.exe
  "C:\Users\Admin\AppData\Local\Temp\F4D52951FC8094515A9E103892247E8E.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Rocks Rocks.bat & Rocks.bat & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5616
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5064
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      PID:5056
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3552
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      PID:4436
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 25250
      4⤵
      PID:2900
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Updating + Achievements + Grown + Individuals + Im 25250\Mariah.pif
      4⤵
      PID:6128
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Bold + Pushed 25250\K
      4⤵
      PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\25250\Mariah.pif
      25250\Mariah.pif 25250\K
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:548
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 localhost
      4⤵
      Runs ping.exe
      PID:6112
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\25250\Mariah.pif
  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\25250\Mariah.pif
  2⤵
  - Executes dropped EXE
  PID:4040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\25250\K
Size 521KB
SHA256 a494a2d085c384484e56951cb7cdc632c492e9563b4e11d75c60e5ae4e3e362d
MD5 cf6ae784d0dcd99d4b325e08bcf70f46
SHA1 b7021d36b93299fcf5e3a9bc9812022965ee4db6
SHA512 d8a57204d1bead897085331b3eb7b837f3edf4fcea2edb3ff277e1eef734927e2f6867b01be136b58c4a70c5fffc68a24a473a8bca6fb905cf454564fd252aa2
SSDEEP 6144:MN8ddg4CHafHPOTxxyIkXRvAXspjTj0j+ZozUqhlP43m:mHAHPqxfopcspjkiSbgW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mariah.pif

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\25250\Mariah.pif
Size 924KB
SHA256 f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
MD5 848164d084384c49937f99d5b894253e
SHA1 3055ef803eeec4f175ebf120f94125717ee12444
SHA512 aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a
SSDEEP 24576:LOo8pEnK4mrqlEZuVZ2HOI+X0l1lMZyYFaeBmyF:LF8p4KpqlEZeXI+X0TVcae3F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Achievements

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Achievements
Size 179KB
SHA256 19b7541af8d6bcf553f05d35867c291745ab3203686290043116ee0b6fb021e5
MD5 50c9188b066737dd074d5a44f2192924
SHA1 fa2d2ef1814eeccd5d53e74c1e1c8023168e21d5
SHA512 034f8ac20d7be7b0aa3368ecca3e0934c04b4f1271bfe362a9bb95aafba91e3c28374d082f8ea0ccbad9df9396f24b9a0b2a4a3aa9720b3e57f83e42763dc456
SSDEEP 3072:mrwzW3Nzl8F5hPLaLWysRIO7vHZnBfzHl8Dz5YaZYvlfA6Gfza6iyY5tVGvH7fsC:m8zwNzlmhPL1b5nZ2tZ6lfA6Gfm608DP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bold

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bold
Size 428KB
SHA256 473ce0064bb230f9aab14549bf2f445bf522cbd20dee50038f5d7cffd3d186bf
MD5 f95ad44d627861ae3a929877f13a2427
SHA1 27a9a9ee0eb4c10eaf3f4259a9b92bf29d8a0d1d
SHA512 4c4cdb979d9aa45501398282cac277a72efd1e19987033b1860272d5a738f04c0c18e42e9da10b9eaf3c361bbf38a6a74e3713dfe52de4bb1dfce5b8884cf80e
SSDEEP 6144:MN8ddg4CHafHPOTxxyIkXRvAXspjTj0j+ZozUqu:mHAHPqxfopcspjkiSu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Grown

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Grown
Size 186KB
SHA256 325f758cbe870050676e3c9de43d969ca3163c76ecc45be94f0fe57a2ef75be8
MD5 4bca61872fdb9a135920ff91cb7e200f
SHA1 c54b5e4631f2752938cc11a1afafbd087d66248b
SHA512 1ab60fcc7a54d5c898f5b2cd37fd01c914021f91d7ac2595c3b6956bb361037aa3d2144ab1b16df76776c9d358e381123d71c943c1eba6a5dba2583f463144be
SSDEEP 3072:xHJJX4xF5jtHk5B+LNBPcAvPTjFq9iOIXyTw0ltj0EowPOGU6WS2uLhxjRYH/fAw:vJX4xNAB+xHFq9O0lHPOGUWLhxjRYmF4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Im
Size 19KB
SHA256 7d270a6900ef6385133b30e462bd157aa925543abaaf248cffe263fae0c33f4b
MD5 29d98b6cbc770d518dfbf5fd2f4fa178
SHA1 1d030e6fd228895d071c28f8e5f70676646f3734
SHA512 8e3e890523a31c0ab4ac80400215fdd860dacedd45baf25e02a61b3f52b7fad8424c632ce2996f6f0a6e69f8a29db838febdab7636e7204b50790ae0adf0e0f6
SSDEEP 384:VR0Xvwp52UW1l/hw50gFQTVaeCV1VEVFJ8ZcGwGBk7/UMQ3K6:SE2UWb/hMjFQTVat3VEV3GPkjI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Individuals

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Individuals
Size 255KB
SHA256 47645a8ec1c2e4e9994af921934c6540907c985b42a5cae3a433e08c0425322d
MD5 ba816771fb03d5a97d7b4c852c73a3b7
SHA1 a6b081fed8d979957ff907725cf04900bd1fec9c
SHA512 9495258389a0d49cbc16c8b655f29733a497e154fa7abb571aea3c730cf619912862385918f692fe3941122df21dc6063e43e3e90e77e2a42b7d0eac38f647e3
SSDEEP 3072:neAg0Fuz08XvBNbIaAtbPf6jKj+wsxjgarB3RZgDWy4ZNogXJ3g:eAOz04pmdV364EgarxUaBZ2mw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pushed

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Pushed
Size 93KB
SHA256 ea19f29eed0f8db4aec25ee745c44b458dbba1debb85db0e4b534e74f126d817
MD5 32ad956152294fb15547493b03ddd703
SHA1 7b0f03ce7e0ebf602a4ba44d52f6515851cf4d70
SHA512 39de8852231e8fc0eb4bf827deaee61d141a4dffd9df2c67462cac27f2694c02edbd9d51cdf0d171fc035724985231607e8665d82423694cb557adc670a62718
SSDEEP 1536:zZq684Yf4YOuRjGCUB+bzVHPhx9vda7lDf7xkZ:dr1+bzVpx4b7xQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Rocks

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Rocks
Size 11KB
SHA256 c294287c6154e553452994711507cd1ec8fd124edabcf4ef8f36b2c97c849f98
MD5 ecb9718d5b111c7826e865c42811a96f
SHA1 7078b71856939261e666f3877275903fdc63f26c
SHA512 0ae55324ba5923dc5ca0eceaa4fdc940d8bfd52c3a6dbc1d5139d8d493db785aa55f0fc03f2f042c4ee0e2631d63bd0906c4bdcf096aa7b1ef7b321f9af9631e
SSDEEP 192:M4IFxyfBX2LQYK3vqFYbRX6U8l/nZeCfFfnUDOuT7YbjO1biyWoloNJ0oobISbc/:M9FxwXl1OoX1oxfF/aLVyJd1q59XndXu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Updating

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Updating
Size 285KB
SHA256 01911bd9e9c36f67e5eb5dcce15e5e2879a7aa29bb386e971ac56bf8efbf4fa8
MD5 d3ff67bd9050dffd6bc274486ab282b1
SHA1 c47ed301597976e6f3889a1575b9659cb79f8100
SHA512 99f3c026c95e1a56c2464d3ae34332e2d0b0406faf89096d2740155d425da8774380b9b8afa05d697fb55ade4958cf68887dc04612ae8f6523cee02fb02d7ba5
SSDEEP 6144:LQBk7JjX74cN0lrztgwU0Wyw3mFygyE4mqd12lqlEAehuqq:LO0z8e0lvSr0Wyw20K4mqClqlEZuD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/548-29-0x0000000077C11000-0x0000000077D31000-memory.dmp

Download

memory/548-31-0x0000000004640000-0x0000000004641000-memory.dmp

Download

memory/4040-32-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4040-33-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4040-35-0x0000000000400000-0x0000000000416000-memory.dmp

Download