raccoon | db721f27c76cf93e1a239e3faeba41c75e78a39ede8b3ce2e735c55ea9681c6f

Analysis

max time kernel
91s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 00:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Wondershare Filmora 13 (UPDATED).exe
Size

878KB
MD5

1f018b011f82f0d25100408933a4f9c3
SHA1

7d169d69cadf027943155732a9021f4f141bd29b
SHA256

db721f27c76cf93e1a239e3faeba41c75e78a39ede8b3ce2e735c55ea9681c6f
SHA512

43d35db6d03a2da666c561748e016168949f1ae2c3ea97694f88d5416e199f2996f021ebfca66be28d03b84ad9d334597329e9b8a3bac2ebdeb8bfa059675143
SSDEEP

24576:1zb5WDTsLLa9X/eI6+Q9ZHVuB0yWn2s5b8:1hULeI6+Q9+ynz4

Score

10^/10

raccoon fd5eb68c7ee1f00597cdb8733bd12ef7 stealer

Malware Config

Extracted

Family

raccoon

Botnet

fd5eb68c7ee1f00597cdb8733bd12ef7

http://195.2.81.45:80/

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 2 IoCs

resource	yara_rule
behavioral2/memory/4544-39-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/4544-41-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4640 created 3508	4640	Glow.pif	43

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	Wondershare Filmora 13 (UPDATED).exe

Executes dropped EXE 2 IoCs

pid	Process
4640	Glow.pif
4544	Glow.pif

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4640 set thread context of 4544	4640	Glow.pif	105

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
4512	tasklist.exe
5104	tasklist.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5084	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4640	Glow.pif
4640	Glow.pif
4640	Glow.pif
4640	Glow.pif
4640	Glow.pif
4640	Glow.pif
4640	Glow.pif
4640	Glow.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4512	tasklist.exe
Token: SeDebugPrivilege	5104	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4640	Glow.pif
4640	Glow.pif
4640	Glow.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4640	Glow.pif
4640	Glow.pif
4640	Glow.pif

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 4172	3076	Wondershare Filmora 13 (UPDATED).exe	90
PID 3076 wrote to memory of 4172	3076	Wondershare Filmora 13 (UPDATED).exe	90
PID 3076 wrote to memory of 4172	3076	Wondershare Filmora 13 (UPDATED).exe	90
PID 4172 wrote to memory of 4512	4172	cmd.exe	92
PID 4172 wrote to memory of 4512	4172	cmd.exe	92
PID 4172 wrote to memory of 4512	4172	cmd.exe	92
PID 4172 wrote to memory of 4608	4172	cmd.exe	93
PID 4172 wrote to memory of 4608	4172	cmd.exe	93
PID 4172 wrote to memory of 4608	4172	cmd.exe	93
PID 4172 wrote to memory of 5104	4172	cmd.exe	96
PID 4172 wrote to memory of 5104	4172	cmd.exe	96
PID 4172 wrote to memory of 5104	4172	cmd.exe	96
PID 4172 wrote to memory of 316	4172	cmd.exe	97
PID 4172 wrote to memory of 316	4172	cmd.exe	97
PID 4172 wrote to memory of 316	4172	cmd.exe	97
PID 4172 wrote to memory of 4876	4172	cmd.exe	99
PID 4172 wrote to memory of 4876	4172	cmd.exe	99
PID 4172 wrote to memory of 4876	4172	cmd.exe	99
PID 4172 wrote to memory of 2056	4172	cmd.exe	100
PID 4172 wrote to memory of 2056	4172	cmd.exe	100
PID 4172 wrote to memory of 2056	4172	cmd.exe	100
PID 4172 wrote to memory of 4504	4172	cmd.exe	101
PID 4172 wrote to memory of 4504	4172	cmd.exe	101
PID 4172 wrote to memory of 4504	4172	cmd.exe	101
PID 4172 wrote to memory of 4640	4172	cmd.exe	102
PID 4172 wrote to memory of 4640	4172	cmd.exe	102
PID 4172 wrote to memory of 4640	4172	cmd.exe	102
PID 4172 wrote to memory of 5084	4172	cmd.exe	103
PID 4172 wrote to memory of 5084	4172	cmd.exe	103
PID 4172 wrote to memory of 5084	4172	cmd.exe	103
PID 4640 wrote to memory of 4544	4640	Glow.pif	105
PID 4640 wrote to memory of 4544	4640	Glow.pif	105
PID 4640 wrote to memory of 4544	4640	Glow.pif	105
PID 4640 wrote to memory of 4544	4640	Glow.pif	105
PID 4640 wrote to memory of 4544	4640	Glow.pif	105

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3508
- C:\Users\Admin\AppData\Local\Temp\Wondershare Filmora 13 (UPDATED).exe
  "C:\Users\Admin\AppData\Local\Temp\Wondershare Filmora 13 (UPDATED).exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Missed Missed.bat & Missed.bat & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4512
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      PID:4608
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5104
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      PID:316
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 10872
      4⤵
      PID:4876
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Senior + Operate + Mozilla + Lap + Tiffany + Trail 10872\Glow.pif
      4⤵
      PID:2056
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Titles + Fields + Dense 10872\f
      4⤵
      PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\10872\Glow.pif
      10872\Glow.pif 10872\f
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4640
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5084
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\10872\Glow.pif
  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\10872\Glow.pif
  2⤵
  - Executes dropped EXE
  PID:4544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\10872\Glow.pif

Filesize
695KB

MD5
447bd89504b790605019f98ab51de11e

SHA1
547c77d1de4f32ab084a589b46ff9dcdcbe984ea

SHA256
512a2d9b52cb43c9623335ae2c0b1246c383aaae39aa305e503c6ea72562a080

SHA512
f1466ec4345fe763357adcbb3264560822086f005ff1ea7559a506a6ad7dc95d87a2149a0621286df59c9952f51f34d8464927d0ebc3a53f9891d3865799418f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\10872\Glow.pif

Filesize
924KB

MD5
848164d084384c49937f99d5b894253e

SHA1
3055ef803eeec4f175ebf120f94125717ee12444

SHA256
f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3

SHA512
aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\10872\f

Filesize
517KB

MD5
d57048700a8ba1a44226d22b42ff8a90

SHA1
db24982ecd40920dbe442b91ff1a81530a726a91

SHA256
3cf55d396093de75a731bbd0343080611490132f99b1de9fd863c596a6d7dbec

SHA512
d94409ad9d711ea589ec382b27e1f54d3bd383540d2d4a4f660b9dc9bf51ff9fa84c6eed7bbfa1d68c3cd25dee72784d5225d102c1977b3136e1b732f8cf6981

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dense

Filesize
4KB

MD5
03af915cfc9a1e8f991afee3949a1a09

SHA1
08f98a48bad06c58b8c953072b72fbd1e9c95e32

SHA256
cfaeb5b793f2b3c4fb25baaf36c824b022eff6012256a1997cb61d0047a75934

SHA512
7fb9cbe98f951b6b0cf21065f3bffe3e4538828e3994263063731bf9bc80e1e9c26be9215cd2bb978a3e8173e66b8e742111555a4b63bb9c0b372b3b84de556d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Fields

Filesize
257KB

MD5
639656b9c91b29dd251dcfec3061c4fd

SHA1
417980e1bfb4a6018d7f9d61ad21f61f8390866e

SHA256
31d06cc321717a205807080d73cb743fcf88f91745f7812c009699cc41978f66

SHA512
28d7ad78f8df1ae91210f6960065118f4b41c444bf779145a21fb70188936b1fa774dad7ec0be2ed1666d78bdb1695154b6ca51660b573dbfb67b4f530290f11

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lap

Filesize
151KB

MD5
1c800e530984ca7045a33a9b4454832a

SHA1
e9e06774b5b1665effabc87653c5fb1c76cc6d72

SHA256
3d4b446e0e847c7c3cd0508f3600710fa29e18d5132ba76035f73cb1f2dca936

SHA512
bedc10fd35a40b602b7bcf738e03bbfc182292784c553371067ee6c1dc78e5e935865fdc95f875418c202ad3eeb1b66313025c06710dc8c6f200702d5c797ba8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Missed

Filesize
10KB

MD5
adbcd838b26f5a3146a79ee41e9e67f3

SHA1
cc08564d7b32b65fb43ff6b0fc729a5fdd8f4898

SHA256
e4b6c5b14a17b5af9f65e8521d4930a0d9ab67063f129b7056ff023203f35c1d

SHA512
5857698d1e29f1a8eb6dd8c5061534b9519beaa5c391e0d78e8eddd899b3055bf5407aa7cf3bac69208f0eeeeb8afc274aa91b8ae90116f16d8bac31516ee59d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Mozilla

Filesize
126KB

MD5
9d51424f9d27b733ec208114bf6af69e

SHA1
3cf7f65097e249333388e8311124c7152b77e852

SHA256
1c85a1607e136a7e4f6e39417a979b5ac3c891b637135977dd3c09324c577609

SHA512
5302c2e6bd2a963b72122e87c3748377f3eca6199c86d3b69819b66306d4b4467869a94194378b692e22793faf9d2dac8c0aa4e20498f13f99008cda2d753ce7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Operate

Filesize
230KB

MD5
236c14538728d4c6f2d39e8ebcb48d62

SHA1
600b6c68d42dc939f3b84a1c1a0d69b31c987162

SHA256
64b78d7c467af1adf32248322c48cb4202f827d76abf626c6905e47bece13c74

SHA512
0bc2ff04ac88665c4e3fe0e5c914e2b8ac224b56b3bcc0148c03b0025ef6c28c42cf25945fab0b6b5a6877847750a559d35a680c43a19c2ff53927a40c8f1558

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Senior

Filesize
121KB

MD5
5427aea2bdb2cd576cd013449d24ebfc

SHA1
0dd772f3bd29ca8ff48656fc8722f05e5506c47c

SHA256
c784d4d1e6c5f0367c9b3e68bd9420559166c57b249260f99abe5c3619f0049c

SHA512
27f032f506fe09e415ca83f456eb5f6007d120faa8d5da845d205bfd9b09618660369710f8bb5f386b2b315e7e33d02081e1e0c2aa8c6ebe17d79a4705102f20

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tiffany

Filesize
259KB

MD5
1b1b44af632d58313fa6e5061469ec8b

SHA1
56ee5b2e8e7d7fda36e3b69547b9e64ed4792302

SHA256
8cd11c8042f222d2d9bbb572aa24441fb3b1734c1797e67d133bf27d1aeb1d3c

SHA512
a4172d43ba951774f33a886fc10b44400a0e16f3835adaefc2f1be4bd1b85172b6c6b125a19894a9388bf7a591a06f205d68072f170f633b79a2dfcbe7f49271

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Titles

Filesize
256KB

MD5
6b0faf8211eb8447245674dbf6fb7a3a

SHA1
5fe96cf8e34cc83d635346686edc651b8cc4e790

SHA256
416461f605eeba41d6ae9992201408d9ea3d3157f26086881b513fb755ed8fb0

SHA512
f4a55c9f2405a279e10f80bec39f11725ac14d95080639abfd83e47f82b9c71e518ba95b8bbd6d6fe119a57aa00ccf81cbe9ed0ba8c65a4c78715328854797af

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Trail

Filesize
37KB

MD5
f5c255fc10e3f542903196e014f7a70a

SHA1
15e2c654a26eea3fa450fdd3d460f6bbef2aee9f

SHA256
b4799a4aed7d13b9c525fccf018828dadc1807d3a311e9ca6186050da31a64bb

SHA512
67eddf81efae94697ef956ebfebd6dece61495e3efa070d6ec5085310b219921d92febf7c6a0b32761e8b979bd29007fad78a8c27bb046bf63e4a2e21cfdc0d1

Download Submit
memory/4544-38-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4544-39-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4544-41-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4640-35-0x00000000770E1000-0x0000000077201000-memory.dmp

Filesize
1.1MB

Download
memory/4640-37-0x0000000003E10000-0x0000000003E11000-memory.dmp

Filesize
4KB

Download