raccoon | 86be7e271ff5976401fab7697d671398ce7612b461326b60bd7c5cf82d5dd413

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 05:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd2dda475065ca19a87fef773d29837c.exe
Size

1.5MB
MD5

cd2dda475065ca19a87fef773d29837c
SHA1

03681c4ba67b25814f388a9ec2331681a104da06
SHA256

86be7e271ff5976401fab7697d671398ce7612b461326b60bd7c5cf82d5dd413
SHA512

bc1a0d0ce804415a7ad6b35ce738145d2417c21bb53c6d803864fc67d96e8dd79b4cb17edd3dd149cdefaf36a9772a21fea1c092bfd73eeea1ee0942d64f7402
SSDEEP

24576:u7WyfNGtTHMF+WNxccRzp6RXiAmJD+1ueBUUIYkBC:oHGBsF+SxF96hiVC1zBUhA

Score

10^/10

raccoon 7ffdc0de40d09810438d04c4d2b8f65bca253baf stealer

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

7ffdc0de40d09810438d04c4d2b8f65bca253baf

Attributes

url4cnc
https://telete.in/happyteslafalcon

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

resource	yara_rule
behavioral1/memory/2504-30-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral1/memory/2504-33-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral1/memory/2504-34-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral1/memory/2504-35-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1

Deletes itself 1 IoCs

pid	Process
2672	Ingranditi.exe.com

Executes dropped EXE 3 IoCs

pid	Process
2716	Ingranditi.exe.com
2672	Ingranditi.exe.com
2504	ipconfig.exe

Loads dropped DLL 3 IoCs

pid	Process
2580	cmd.exe
2716	Ingranditi.exe.com
2672	Ingranditi.exe.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2672 set thread context of 2504	2672	Ingranditi.exe.com	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2504	ipconfig.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	ipconfig.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	ipconfig.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2392	PING.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2672	Ingranditi.exe.com
2672	Ingranditi.exe.com
2672	Ingranditi.exe.com
2672	Ingranditi.exe.com
2672	Ingranditi.exe.com
2672	Ingranditi.exe.com
2672	Ingranditi.exe.com
2672	Ingranditi.exe.com
2672	Ingranditi.exe.com

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2672	Ingranditi.exe.com

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2492	1992	cd2dda475065ca19a87fef773d29837c.exe	28
PID 1992 wrote to memory of 2492	1992	cd2dda475065ca19a87fef773d29837c.exe	28
PID 1992 wrote to memory of 2492	1992	cd2dda475065ca19a87fef773d29837c.exe	28
PID 1992 wrote to memory of 2492	1992	cd2dda475065ca19a87fef773d29837c.exe	28
PID 2492 wrote to memory of 2580	2492	cmd.exe	30
PID 2492 wrote to memory of 2580	2492	cmd.exe	30
PID 2492 wrote to memory of 2580	2492	cmd.exe	30
PID 2492 wrote to memory of 2580	2492	cmd.exe	30
PID 2580 wrote to memory of 2608	2580	cmd.exe	31
PID 2580 wrote to memory of 2608	2580	cmd.exe	31
PID 2580 wrote to memory of 2608	2580	cmd.exe	31
PID 2580 wrote to memory of 2608	2580	cmd.exe	31
PID 2580 wrote to memory of 2716	2580	cmd.exe	32
PID 2580 wrote to memory of 2716	2580	cmd.exe	32
PID 2580 wrote to memory of 2716	2580	cmd.exe	32
PID 2580 wrote to memory of 2716	2580	cmd.exe	32
PID 2580 wrote to memory of 2392	2580	cmd.exe	33
PID 2580 wrote to memory of 2392	2580	cmd.exe	33
PID 2580 wrote to memory of 2392	2580	cmd.exe	33
PID 2580 wrote to memory of 2392	2580	cmd.exe	33
PID 2716 wrote to memory of 2672	2716	Ingranditi.exe.com	34
PID 2716 wrote to memory of 2672	2716	Ingranditi.exe.com	34
PID 2716 wrote to memory of 2672	2716	Ingranditi.exe.com	34
PID 2716 wrote to memory of 2672	2716	Ingranditi.exe.com	34
PID 2672 wrote to memory of 2504	2672	Ingranditi.exe.com	35
PID 2672 wrote to memory of 2504	2672	Ingranditi.exe.com	35
PID 2672 wrote to memory of 2504	2672	Ingranditi.exe.com	35
PID 2672 wrote to memory of 2504	2672	Ingranditi.exe.com	35
PID 2672 wrote to memory of 2504	2672	Ingranditi.exe.com	35

C:\Users\Admin\AppData\Local\Temp\cd2dda475065ca19a87fef773d29837c.exe
"C:\Users\Admin\AppData\Local\Temp\cd2dda475065ca19a87fef773d29837c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cmd < Chiamando.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^vMTXZfRbDiFjhouYfDZWbLTTynJzpkQjrEXNpogAoVarczDEuNhSnblKTZSAFngsszpJkzPifnOBzPnMVtjcXXNGzhTpfNVJHwMelTzMXuCZJJsrBuFAkSzzFCdXm$" Sua.html
      4⤵
      PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ingranditi.exe.com
      Ingranditi.exe.com e
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ingranditi.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ingranditi.exe.com e
        5⤵
        Deletes itself
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ipconfig.exe
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ipconfig.exe
        6⤵
        Executes dropped EXE
        Gathers network information
        Modifies system certificate store
        
        PID:2504
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 30
      4⤵
      Runs ping.exe
      PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Chiamando.html

Filesize
451B

MD5
d364be2ce0e241a028d7417486ab4ded

SHA1
658430b4fe71bf63007a4af9722a396adf4ed67a

SHA256
e596a84d0a8719bbe6eca4e59cb7a6f16c64f1bb6500edf5405ba857c3e6a5dc

SHA512
0f10f84850db38e8df6d77df0ebaeacf79a1fa00d84783a9eee40eda99e29d33e453d477427cd504f200a30043b1c5e56415e5d41d9145d90fce4b45be2d843d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Pareva.html

Filesize
583KB

MD5
f40641f6724a17eb3cc8bb4404caa6b4

SHA1
bd78862c8dbe4d583ba618e5fa1d2812f50726e5

SHA256
b9070989900ce4b0f2d4e1ef2ec4708355ae3736296d10843666b4285c308f8e

SHA512
ad3d90f523a7334e37932a3543390ccde9bacc9f628138a524426f91c118d8dcc9a69219886c4b8987046d465686acdbd3fc8dff12f9b1cdf6171aa295515440

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sua.html

Filesize
872KB

MD5
2fca4116a24e435da278eba9b4d141d6

SHA1
9c6c076c2dd023c8709bd398d9d19b6f6f9ebc30

SHA256
7ea5b7a7fe7d29efce69bd4d5cc704ce48d5316f9ccc7678755f92b327a8ddc0

SHA512
d751f80e42bce965940df55042348342ef35811b409d67be7691386c5cdbc5c0fa85ac6a193261277362e07f4004c92869d86947f803beecdec56a9e5c65e315

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Svelto.html

Filesize
990KB

MD5
30756a814cb126d3aaade64144a787c5

SHA1
c01865957f301263bc01ffe08fbdb4af2a3df7b1

SHA256
4278eecfba9f76966fa4673ab5cf9d7470984fdb21b00dfa8256199e39eb8262

SHA512
93ef957a21a67e46e334e8a4e8f1b2b55ea7d6fcf51e475db6bf18f8b3f7642b8f896f23adbe5061c5641d041aff14d447ed7ac7f2cf8104f8ad094f7c8cfe20

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ingranditi.exe.com

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ipconfig.exe

Filesize
26KB

MD5
cabb20e171770ff64614a54c1f31c033

SHA1
ea18043fedaf888f04c07f71f2006f3f479c0b41

SHA256
c0e3087d87c84776fe7ffca768a0793c02d28e34a821f0c9da32339af8e7e6a6

SHA512
a6a6beff693f2e2c71c0d8e12f6964e789aa4b370c1e0191b2b0ff038801fdb0038a54c0a8f2dbc0d399d2c016f89701c6b6275b3a2b6fa74fb2a5ea817c2d3b

Download Submit
memory/2504-30-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2504-33-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2504-34-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2504-35-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2672-25-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2672-28-0x0000000000200000-0x0000000000202000-memory.dmp

Filesize
8KB

Download