raccoon | ceb6b3d9b2ae0430495caaecedbdd494ff5cd44cb24780cbbb2863efa9386182

Analysis

max time kernel
130s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ad27c002c314717f78cadab27bf049cf.exe
Size 768KB
Sample240313-jsn1tsgc4v
SHA256 ceb6b3d9b2ae0430495caaecedbdd494ff5cd44cb24780cbbb2863efa9386182
MD5 ad27c002c314717f78cadab27bf049cf
SHA1 8467513920df45cc742760f05fef909b54a95261
SHA512 a691790f69341f28173e6a83200480af952ca35af0724d670d8b4a52264c991cfb61ee6cc513615414a2864071244753b84122d493a67f2f73d47a2395e5255e
SSDEEP 24576:gbGdMU29P/8RLgad7P3BeJlDff4WGVF9kkzB:qG+xsZgg7fMJlDIVFTzB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

raccoon 4076618ff41b7d8c15ac86f265ebc66d stealer

Malware Config

Extracted

Family

raccoon

Botnet

4076618ff41b7d8c15ac86f265ebc66d

http://82.146.45.177:80/

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 2 IoCs

resource	yara_rule
behavioral2/memory/472-27-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/472-29-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2536 created 3344	2536	Victoria.pif	56

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	ad27c002c314717f78cadab27bf049cf.exe

Executes dropped EXE 2 IoCs

pid	Process
2536	Victoria.pif
472	Victoria.pif

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2536 set thread context of 472	2536	Victoria.pif	103

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
4084	tasklist.exe
3836	tasklist.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1132	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2536	Victoria.pif
2536	Victoria.pif
2536	Victoria.pif
2536	Victoria.pif
2536	Victoria.pif
2536	Victoria.pif
2536	Victoria.pif
2536	Victoria.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4084	tasklist.exe
Token: SeDebugPrivilege	3836	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2536	Victoria.pif
2536	Victoria.pif
2536	Victoria.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2536	Victoria.pif
2536	Victoria.pif
2536	Victoria.pif

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 2920	3156	ad27c002c314717f78cadab27bf049cf.exe	85
PID 3156 wrote to memory of 2920	3156	ad27c002c314717f78cadab27bf049cf.exe	85
PID 3156 wrote to memory of 2920	3156	ad27c002c314717f78cadab27bf049cf.exe	85
PID 2920 wrote to memory of 4084	2920	cmd.exe	87
PID 2920 wrote to memory of 4084	2920	cmd.exe	87
PID 2920 wrote to memory of 4084	2920	cmd.exe	87
PID 2920 wrote to memory of 4284	2920	cmd.exe	88
PID 2920 wrote to memory of 4284	2920	cmd.exe	88
PID 2920 wrote to memory of 4284	2920	cmd.exe	88
PID 2920 wrote to memory of 3836	2920	cmd.exe	90
PID 2920 wrote to memory of 3836	2920	cmd.exe	90
PID 2920 wrote to memory of 3836	2920	cmd.exe	90
PID 2920 wrote to memory of 2616	2920	cmd.exe	91
PID 2920 wrote to memory of 2616	2920	cmd.exe	91
PID 2920 wrote to memory of 2616	2920	cmd.exe	91
PID 2920 wrote to memory of 2056	2920	cmd.exe	92
PID 2920 wrote to memory of 2056	2920	cmd.exe	92
PID 2920 wrote to memory of 2056	2920	cmd.exe	92
PID 2920 wrote to memory of 2544	2920	cmd.exe	93
PID 2920 wrote to memory of 2544	2920	cmd.exe	93
PID 2920 wrote to memory of 2544	2920	cmd.exe	93
PID 2920 wrote to memory of 4600	2920	cmd.exe	94
PID 2920 wrote to memory of 4600	2920	cmd.exe	94
PID 2920 wrote to memory of 4600	2920	cmd.exe	94
PID 2920 wrote to memory of 2536	2920	cmd.exe	95
PID 2920 wrote to memory of 2536	2920	cmd.exe	95
PID 2920 wrote to memory of 2536	2920	cmd.exe	95
PID 2920 wrote to memory of 1132	2920	cmd.exe	96
PID 2920 wrote to memory of 1132	2920	cmd.exe	96
PID 2920 wrote to memory of 1132	2920	cmd.exe	96
PID 2536 wrote to memory of 472	2536	Victoria.pif	103
PID 2536 wrote to memory of 472	2536	Victoria.pif	103
PID 2536 wrote to memory of 472	2536	Victoria.pif	103
PID 2536 wrote to memory of 472	2536	Victoria.pif	103
PID 2536 wrote to memory of 472	2536	Victoria.pif	103

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3344
- C:\Users\Admin\AppData\Local\Temp\ad27c002c314717f78cadab27bf049cf.exe
  "C:\Users\Admin\AppData\Local\Temp\ad27c002c314717f78cadab27bf049cf.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Latter Latter.bat & Latter.bat & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4084
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      PID:4284
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3836
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      PID:2616
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 32528
      4⤵
      PID:2056
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Prev + Objectives + Publishing + Planning + Eight 32528\Victoria.pif
      4⤵
      PID:2544
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Designation + Chorus + Place 32528\B
      4⤵
      PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\32528\Victoria.pif
      32528\Victoria.pif 32528\B
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2536
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1132
- C:\Users\Admin\AppData\Local\Temp\32528\Victoria.pif
  C:\Users\Admin\AppData\Local\Temp\32528\Victoria.pif
  2⤵
  - Executes dropped EXE
  PID:472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\Local\Temp\32528\B
Size 521KB
SHA256 ee33bc9748fc3f2799d43df04ead1df383764f6a00e85cb6865a456b1023bf27
MD5 2ea6936964f3396a440d6fcd1d0e6a40
SHA1 c1b605042274a26061f9b3acf6e3e3c84d0dd27d
SHA512 8e3c462a5ab1f47e834ebbe64a320d68d7e98dc5a50a3d21127d9731c168dcd64a1ed77a33c514d2cbe56daa981073942eb878504e58cffd864f28c68facbba5
SSDEEP 6144:J8NRCzE9CY3h5h92QWQUxGsFq/MnH4PQY8wNmtxjGdcFMk/IpyYaiuX:JO9CgtyVGdv8X
MD5 SHA1 SHA512 SSDEEP

Submit Download

Victoria.pif

Path C:\Users\Admin\AppData\Local\Temp\32528\Victoria.pif
Size 924KB
SHA256 f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
MD5 848164d084384c49937f99d5b894253e
SHA1 3055ef803eeec4f175ebf120f94125717ee12444
SHA512 aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a
SSDEEP 24576:LOo8pEnK4mrqlEZuVZ2HOI+X0l1lMZyYFaeBmyF:LF8p4KpqlEZeXI+X0TVcae3F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chorus

Path C:\Users\Admin\AppData\Local\Temp\Chorus
Size 296KB
SHA256 68c92d709cd12a0decce387d841e41519f68979ff305aff68738a81e538c2434
MD5 6289f0044be469e5cc5d78425de1ecd2
SHA1 1633cbe5c9c79ff74cef4ef8d44221d16dc7c674
SHA512 256d3016d615d47f71f762b339ef842d1da613323aa8beb3b67afbb3271b5a5001e470d9331039fbf5600b87e49d40fe41af29dd96cdaef8af37dfee37c83f70
SSDEEP 6144:OFq/MnH4PQY8wNmtxjGdcFMk/IpyYaiu4:1yVGdv84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Designation

Path C:\Users\Admin\AppData\Local\Temp\Designation
Size 209KB
SHA256 5ff84c86bbb50331fb0a8dda84591ff259d236aa54fb1c7e14e420e916d340cc
MD5 c1cc1aa18b9007c18d77d379897ca025
SHA1 64c85a49243812f66e0dd819129cb99ee10ef763
SHA512 791c7cdc14c4947460327d9cb4b9a524dcf948ece3f96446a0d8da8cd938922dcb5695a16b011ab7910581341ca1b0088dc1df7f45712dfdcb78a2058d56c310
SSDEEP 3072:J8NRCzqq/gNDCFPqWvMh5h92CjBf8QUnxoBVp:J8NRCzE9CY3h5h92QWQUxGp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Eight

Path C:\Users\Admin\AppData\Local\Temp\Eight
Size 76KB
SHA256 d38464b74940765c78bf06478029f2366bfbca7c9b965c164efb2886e98c3d6a
MD5 521f2aed387524bdd7052bb4f23c0018
SHA1 7c57b9c934705f1ba9418840afef2f0af8e69168
SHA512 73366414419bb41c192a74f56a94c867d50187c24e07cc9ac33f4dbab31ea756671dc879a9bf78735596f8c96976fd595dd987702daadd9b8b25ea543a12c474
SSDEEP 1536:YWyu0uZo2+9BkxXiblenlJJyIE2UWb/hoQZ2OE3:YWy4ZNogXJ3i2Umb2Oq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Latter

Path C:\Users\Admin\AppData\Local\Temp\Latter
Size 12KB
SHA256 dfab3a6b7e63339e8a23e9270cbbd49fa5d9efe42512339e1a7a915bd04d7b10
MD5 202cd0ed4d5a42ef36c223e2e041bae9
SHA1 814d8e675a6c57811052f1f116e51605f11c5c7a
SHA512 e66ab9d35dbc6cb593f90b31d739fd361bb2426f8137121b6f297663b970ba8e2ffd0e53e72d3137ce705ebee3f254646fc6d350b0fcb432276761b664f7cb60
SSDEEP 384:OcIIiDCEhU1Lav5FH5JHFGVVM0nOqrhp0njsJXjJHWn6VV2Nv6TXW:OcRY361GrH5BFGVO0nrrX0nj8XjBWn6S
MD5 SHA1 SHA512 SSDEEP

Submit Download

Objectives

Path C:\Users\Admin\AppData\Local\Temp\Objectives
Size 109KB
SHA256 21cc51aee34eef0c66dbc4c633bedc390dba87482289b7a31e15806b9dfb60ad
MD5 93fc6d378cf9f3e4bd856b24e758032b
SHA1 23509fad0ad1dc5cead9b4f8e0efe2b1a52c2536
SHA512 e8304645ae862af43af2d8596626764420a4c6acaa4cb1a4a1eacab231a0351a04b1130609c34e8b2c58e13b97f048af5f97bcbcee8ace3eef9955228b57285e
SSDEEP 3072:n/33SrF7etHufKE5Kmqd1UhlqRWO/9EAehuqCB:/3mFygyE4mqd12lqlEAehuqe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Place

Path C:\Users\Admin\AppData\Local\Temp\Place
Size 16KB
SHA256 5db649df3c48e3e7e47f9bfa222fc229b4a000dadd9d12b83fde569ed2ee81a3
MD5 9ea9a13f6966bda0647d6f83f6d257fb
SHA1 36d5c6d95368508c5878bf08e2a2bc753aaf7aec
SHA512 4c3a3359777a16c190973eefd001e166f76dee32482493b0da2c635b90a143aef35a36101ff66daa1b60eeaec945c3d93a8d82b51cc8a70e48bc6b9c3199db2a
SSDEEP 384:7GllELAN54L8RD1APZpwk5AG8n7uiQalnvfrfGNp3zuDGS:2IEkHZ5ATdlnijut
MD5 SHA1 SHA512 SSDEEP

Submit Download

Planning

Path C:\Users\Admin\AppData\Local\Temp\Planning
Size 284KB
SHA256 fb7337b18c69464c4c84b9ecb69d62f6f693460c86d0e5ab3586c315c59cac97
MD5 9bb02422262416ba9e804e520ab576be
SHA1 3d6b62a8f9d8d846c8e05495819b5320ada507c6
SHA512 febc9d3221329aa1150dc3b1b81afe858634bb3a096939ae5cbef87d9c7dc3613265baf1e40befac34798ac186802d17437f04cadff4b3ade71332647ece10e9
SSDEEP 6144:HHPOGUWLhxjRYmFqZvEAOz04pmdV364EgarxU8:HHPOGNnlMZce4wdV5Egae8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Prev
Size 173KB
SHA256 d4dce3c852197709b13ad7a426d2e515d3d7d0d52d79d4b1de7f3c8e5f881ff3
MD5 8d019b45973901b4854eec33096d05c0
SHA1 1dfb37a78659ba3917c6479ead9c9f645bbb8331
SHA512 9e23a4d76c707476e0c342dc6468c153571a5e1a106397d80c8ade95682119bd3bfe45ba803521327d61d926c14bcb3b61fd1869de4881956453a53183e98af1
SSDEEP 3072:pPpU08BjlWTPJth26X7Sn4UfpLUNN9t68cCWlrss4M5iRq3U0Pe3vHU4Sm:LQBk7JjX74cN0lrztgwU0Wym
MD5 SHA1 SHA512 SSDEEP

Submit Download

Publishing

Path C:\Users\Admin\AppData\Local\Temp\Publishing
Size 282KB
SHA256 d2ad4b17ef916f37ba03c3a7f5c3e3733a7b63bc18eda759f0e8744d682af9c4
MD5 5c3dd15e00b94c2d9b169d10e4f89144
SHA1 32f0c00bcf18cc51ed0ff7bcab2cb6b62ff08620
SHA512 1f4c9bc47efe1c5644042daa5575dd2fbfc92de604b1af7c70fb77070f5b1d2928811d84e47ddabae08b4bf7248a23c66690413d6a75cb1b683e3c893068c4eb
SSDEEP 6144:e8zwNzlmhPL1b5nZ2tZ6lfA6Gfm608DsvqJX4xNAB+xHFq9O0p:N1b5Z2tZ6XKmNvqJWNAB+X0p
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/472-26-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/472-27-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/472-29-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/2536-23-0x0000000077681000-0x00000000777A1000-memory.dmp

Download

memory/2536-25-0x0000000003F60000-0x0000000003F61000-memory.dmp

Download