Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
27/02/2024, 03:26
General
- Target a8192caf36675e4df1183edad5729339.exe
- Size 1.9MB
- Sample240227-dzfedafe71
- SHA256 030835b911a792bc95541c70aedd715590b4a33b740d3007e3d37334edcd103c
Malware Config
Signatures
- Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
- Raccoon Stealer V1 payload 17 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8192caf36675e4df1183edad5729339.exe"C:\Users\Admin\AppData\Local\Temp\a8192caf36675e4df1183edad5729339.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3460-0-0x0000000000AA0000-0x0000000000F7C000-memory.dmp
memory/3460-1-0x0000000077D14000-0x0000000077D16000-memory.dmp
memory/3460-2-0x0000000000AA0000-0x0000000000F7C000-memory.dmp
memory/3460-3-0x00000000054C0000-0x00000000054C1000-memory.dmp
memory/3460-5-0x0000000005420000-0x0000000005421000-memory.dmp
memory/3460-4-0x0000000005490000-0x0000000005491000-memory.dmp
memory/3460-6-0x00000000054B0000-0x00000000054B1000-memory.dmp
memory/3460-7-0x0000000005470000-0x0000000005471000-memory.dmp
memory/3460-9-0x0000000005450000-0x0000000005451000-memory.dmp
memory/3460-8-0x00000000054E0000-0x00000000054E1000-memory.dmp
memory/3460-10-0x00000000054D0000-0x00000000054D1000-memory.dmp
memory/3460-11-0x0000000005480000-0x0000000005481000-memory.dmp
memory/3460-12-0x0000000005440000-0x0000000005441000-memory.dmp
memory/3460-13-0x0000000005500000-0x0000000005501000-memory.dmp
memory/3460-14-0x00000000054F0000-0x00000000054F2000-memory.dmp
memory/3460-15-0x0000000000AA0000-0x0000000000F7C000-memory.dmp
memory/3460-16-0x0000000000AA0000-0x0000000000F7C000-memory.dmp
memory/3460-17-0x0000000000AA0000-0x0000000000F7C000-memory.dmp
memory/3460-18-0x0000000000AA0000-0x0000000000F7C000-memory.dmp
memory/3460-19-0x0000000000AA0000-0x0000000000F7C000-memory.dmp
memory/3460-20-0x0000000000AA0000-0x0000000000F7C000-memory.dmp
memory/3460-21-0x0000000000AA0000-0x0000000000F7C000-memory.dmp
memory/3460-22-0x0000000000AA0000-0x0000000000F7C000-memory.dmp
memory/3460-23-0x0000000000AA0000-0x0000000000F7C000-memory.dmp
memory/3460-24-0x0000000000AA0000-0x0000000000F7C000-memory.dmp
memory/3460-25-0x0000000000AA0000-0x0000000000F7C000-memory.dmp
memory/3460-26-0x0000000000AA0000-0x0000000000F7C000-memory.dmp
memory/3460-27-0x0000000000AA0000-0x0000000000F7C000-memory.dmp
memory/3460-28-0x0000000000AA0000-0x0000000000F7C000-memory.dmp
memory/3460-29-0x0000000000AA0000-0x0000000000F7C000-memory.dmp
memory/3460-30-0x0000000000AA0000-0x0000000000F7C000-memory.dmp