raccoon | 79e74116d9b6641a89f62b78d9b51450612c33cb346d1c86521ce5a8313d24c6

General

Target

4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe
Size

24.2MB
MD5

4f9a9b1b7da87ecd06db9996d7d4acfe
SHA1

f813c4b15688d02a467155148c95b75e85aa449f
SHA256

79e74116d9b6641a89f62b78d9b51450612c33cb346d1c86521ce5a8313d24c6
SHA512

94e83197964e4a26c2320423c5d587c29f13d955ffaa69dc9ea50b6be5e91bf397bb29f1ff76b24329ad859e8f3c20d81dbf73f8cd39f72efaba4046553034cd
SSDEEP

393216:3spvgNx6jckByvGeTE0xwtL32JZSlkjWRtuK9JlLir2DrdGPpViRzieLbrK:gvSxBxamXSlll9JZ+0rdyiRzdL

Score

10^/10

raccoon evasion stealer themida trojan

Malware Config

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 9 IoCs

resource	yara_rule
behavioral1/memory/2004-29-0x0000000000AF0000-0x0000000001061000-memory.dmp	family_raccoon_v1
behavioral1/memory/2004-27-0x0000000000AF0000-0x0000000001061000-memory.dmp	family_raccoon_v1
behavioral1/memory/2004-30-0x0000000000AF0000-0x0000000001061000-memory.dmp	family_raccoon_v1
behavioral1/memory/2004-36-0x0000000000AF0000-0x0000000001061000-memory.dmp	family_raccoon_v1
behavioral1/memory/2004-37-0x0000000000AF0000-0x0000000001061000-memory.dmp	family_raccoon_v1
behavioral1/memory/2004-38-0x0000000000AF0000-0x0000000001061000-memory.dmp	family_raccoon_v1
behavioral1/memory/2004-39-0x0000000000AF0000-0x0000000001061000-memory.dmp	family_raccoon_v1
behavioral1/memory/2004-253-0x0000000000AF0000-0x0000000001061000-memory.dmp	family_raccoon_v1
behavioral1/memory/2004-263-0x0000000000AF0000-0x0000000001061000-memory.dmp	family_raccoon_v1

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	AdGuard.v7.7.3715.0.Svc_fXPKH.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AdGuard.v7.7.3715.0.Svc_fXPKH.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	AdGuard.v7.7.3715.0.Svc_fXPKH.exe

Executes dropped EXE 2 IoCs

pid	Process
2004	AdGuard.v7.7.3715.0.Svc_fXPKH.exe
2724	AdGuard.v7.7.3715.0_vZ1t4.exe

Loads dropped DLL 9 IoCs

pid	Process
2628	4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe
2628	4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe
2628	4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe
2628	4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe
2628	4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe
2628	4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe
2628	4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe
2628	4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe
2628	4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe

Themida packer 12 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x00040000000130fc-5.dat	themida
behavioral1/memory/2004-25-0x0000000000AF0000-0x0000000001061000-memory.dmp	themida
behavioral1/memory/2004-26-0x0000000000AF0000-0x0000000001061000-memory.dmp	themida
behavioral1/memory/2004-29-0x0000000000AF0000-0x0000000001061000-memory.dmp	themida
behavioral1/memory/2004-27-0x0000000000AF0000-0x0000000001061000-memory.dmp	themida
behavioral1/memory/2004-30-0x0000000000AF0000-0x0000000001061000-memory.dmp	themida
behavioral1/memory/2004-36-0x0000000000AF0000-0x0000000001061000-memory.dmp	themida
behavioral1/memory/2004-37-0x0000000000AF0000-0x0000000001061000-memory.dmp	themida
behavioral1/memory/2004-38-0x0000000000AF0000-0x0000000001061000-memory.dmp	themida
behavioral1/memory/2004-39-0x0000000000AF0000-0x0000000001061000-memory.dmp	themida
behavioral1/memory/2004-253-0x0000000000AF0000-0x0000000001061000-memory.dmp	themida
behavioral1/memory/2004-263-0x0000000000AF0000-0x0000000001061000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AdGuard.v7.7.3715.0.Svc_fXPKH.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2004	AdGuard.v7.7.3715.0.Svc_fXPKH.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
944	msiexec.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeShutdownPrivilege	944	msiexec.exe
Token: SeIncreaseQuotaPrivilege	944	msiexec.exe
Token: SeRestorePrivilege	1120	msiexec.exe
Token: SeTakeOwnershipPrivilege	1120	msiexec.exe
Token: SeSecurityPrivilege	1120	msiexec.exe
Token: SeCreateTokenPrivilege	944	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	944	msiexec.exe
Token: SeLockMemoryPrivilege	944	msiexec.exe
Token: SeIncreaseQuotaPrivilege	944	msiexec.exe
Token: SeMachineAccountPrivilege	944	msiexec.exe
Token: SeTcbPrivilege	944	msiexec.exe
Token: SeSecurityPrivilege	944	msiexec.exe
Token: SeTakeOwnershipPrivilege	944	msiexec.exe
Token: SeLoadDriverPrivilege	944	msiexec.exe
Token: SeSystemProfilePrivilege	944	msiexec.exe
Token: SeSystemtimePrivilege	944	msiexec.exe
Token: SeProfSingleProcessPrivilege	944	msiexec.exe
Token: SeIncBasePriorityPrivilege	944	msiexec.exe
Token: SeCreatePagefilePrivilege	944	msiexec.exe
Token: SeCreatePermanentPrivilege	944	msiexec.exe
Token: SeBackupPrivilege	944	msiexec.exe
Token: SeRestorePrivilege	944	msiexec.exe
Token: SeShutdownPrivilege	944	msiexec.exe
Token: SeDebugPrivilege	944	msiexec.exe
Token: SeAuditPrivilege	944	msiexec.exe
Token: SeSystemEnvironmentPrivilege	944	msiexec.exe
Token: SeChangeNotifyPrivilege	944	msiexec.exe
Token: SeRemoteShutdownPrivilege	944	msiexec.exe
Token: SeUndockPrivilege	944	msiexec.exe
Token: SeSyncAgentPrivilege	944	msiexec.exe
Token: SeEnableDelegationPrivilege	944	msiexec.exe
Token: SeManageVolumePrivilege	944	msiexec.exe
Token: SeImpersonatePrivilege	944	msiexec.exe
Token: SeCreateGlobalPrivilege	944	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2628	4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe
2628	4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe
2628	4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe
2628	4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe
944	msiexec.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2628	4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe
2628	4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe
2628	4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe
2628	4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2004	2628	4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe	28
PID 2628 wrote to memory of 2004	2628	4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe	28
PID 2628 wrote to memory of 2004	2628	4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe	28
PID 2628 wrote to memory of 2004	2628	4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe	28
PID 2628 wrote to memory of 2724	2628	4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe	29
PID 2628 wrote to memory of 2724	2628	4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe	29
PID 2628 wrote to memory of 2724	2628	4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe	29
PID 2628 wrote to memory of 2724	2628	4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe	29
PID 2724 wrote to memory of 944	2724	AdGuard.v7.7.3715.0_vZ1t4.exe	30
PID 2724 wrote to memory of 944	2724	AdGuard.v7.7.3715.0_vZ1t4.exe	30
PID 2724 wrote to memory of 944	2724	AdGuard.v7.7.3715.0_vZ1t4.exe	30
PID 2724 wrote to memory of 944	2724	AdGuard.v7.7.3715.0_vZ1t4.exe	30
PID 2724 wrote to memory of 944	2724	AdGuard.v7.7.3715.0_vZ1t4.exe	30
PID 2724 wrote to memory of 944	2724	AdGuard.v7.7.3715.0_vZ1t4.exe	30
PID 2724 wrote to memory of 944	2724	AdGuard.v7.7.3715.0_vZ1t4.exe	30

C:\Users\Admin\AppData\Local\Temp\4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2628
- C:\ProgramData\AdGuard.v7.7.3715.0.Svc_fXPKH.exe
  "C:\ProgramData\AdGuard.v7.7.3715.0.Svc_fXPKH.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2004
- C:\ProgramData\AdGuard.v7.7.3715.0_vZ1t4.exe
  "C:\ProgramData\AdGuard.v7.7.3715.0_vZ1t4.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\ProgramData\Package Cache\{685F6AB3-7C61-42D1-AE5B-3864E48D1035}v7.7.3715.0\setup.msi" TRANSFORMS=tr.mst
    3⤵
    - Enumerates connected drives
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:944

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

4

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AdGuard.v7.7.3715.0.Svc_fXPKH.exe

Filesize
2.0MB

MD5
b053fb4457f829f8a2cefdd6d4f46d20

SHA1
d67bd1595c6ebcdbbaa28a7bd35054cecf3daa5f

SHA256
c290cebb313e2413bcf84cd70135def846647cf2eca27e9a61ecb71e60cc2e0e

SHA512
27371a7fe25431949e20e77330d5b20cef3524bca6652934513a264efcc4379c4277c1386dee6bb8331fb57bd636e87bf7dcb85c6ae9c852cd4c8b92ff6b0636

Download Submit
C:\ProgramData\AdGuard.v7.7.3715.0_vZ1t4.exe

Filesize
21.3MB

MD5
35b0f868fe979536190b3d4336b18d25

SHA1
3a337dc2cea9e10ce86b6dd04b907edd509d4318

SHA256
7cdb377bedd16763cea656b92392490d1762c3804214fd80dc734387e9c518f6

SHA512
3c6cb441b72ab50bfca9e03a933abf95979db95c0a0505648fb7bd2a89987477f95ae2611d18613a7ef12b29b991e0b4ce9961afc1f39db63fc9cc03e8828b17

Download Submit
C:\ProgramData\Package Cache\{685F6AB3-7C61-42D1-AE5B-3864E48D1035}v7.7.3715.0\setup.msi

Filesize
3.7MB

MD5
ed6084ab9f2cb4dddcdd796ac353523b

SHA1
95ace7a94b4ae8efc6f84be9da0ab05c4360f3d7

SHA256
197b90e9201c1c7ba2eec1ed41725f280b2ec341014f45b3e40756f9cff0330e

SHA512
0e7fb938b76a98afd683caeee3119fd5bb8a8179e3bdb6ed2e16bf4545f46689833df3150ac1df30e0f45c17d091bcded806eaba41aa77ae67b3b97b9f7f6e4d

Download Submit
C:\ProgramData\Package Cache\{685F6AB3-7C61-42D1-AE5B-3864E48D1035}v7.7.3715.0\tr.mst

Filesize
300KB

MD5
63f3811710ffa84f0fbb7752459177d3

SHA1
6e6f7d5c8077be9e62e8686846f639dea61da364

SHA256
68225c4c5d6c29323403db04f8f87f099b055dc1ea40d14c06c9d9be340d6c60

SHA512
3e41ebff35a83f40e7181862db46ab645c5fde5494e5a68ac06ac8c708016f0bbb3a2221c28c7888bb3ac7df54f214d1a0c2c1172c1803cc7a97eb5f041072d2

Download Submit
memory/2004-30-0x0000000000AF0000-0x0000000001061000-memory.dmp

Filesize
5.4MB

Download
memory/2004-38-0x0000000000AF0000-0x0000000001061000-memory.dmp

Filesize
5.4MB

Download
memory/2004-29-0x0000000000AF0000-0x0000000001061000-memory.dmp

Filesize
5.4MB

Download
memory/2004-27-0x0000000000AF0000-0x0000000001061000-memory.dmp

Filesize
5.4MB

Download
memory/2004-26-0x0000000000AF0000-0x0000000001061000-memory.dmp

Filesize
5.4MB

Download
memory/2004-36-0x0000000000AF0000-0x0000000001061000-memory.dmp

Filesize
5.4MB

Download
memory/2004-37-0x0000000000AF0000-0x0000000001061000-memory.dmp

Filesize
5.4MB

Download
memory/2004-28-0x0000000077CF0000-0x0000000077CF2000-memory.dmp

Filesize
8KB

Download
memory/2004-39-0x0000000000AF0000-0x0000000001061000-memory.dmp

Filesize
5.4MB

Download
memory/2004-25-0x0000000000AF0000-0x0000000001061000-memory.dmp

Filesize
5.4MB

Download
memory/2004-263-0x0000000000AF0000-0x0000000001061000-memory.dmp

Filesize
5.4MB

Download
memory/2004-253-0x0000000000AF0000-0x0000000001061000-memory.dmp

Filesize
5.4MB

Download
memory/2628-22-0x0000000005B20000-0x0000000006091000-memory.dmp

Filesize
5.4MB

Download
memory/2628-23-0x0000000005B20000-0x0000000006091000-memory.dmp

Filesize
5.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads