Analysis
- max time kernel
18s - max time network
19s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
09/07/2024, 16:46
General
- Target Patch.exe
- Size 588KB
- Sample240709-vac2dstcrk
- SHA256 7b949ec5f73dff9e83d9c5e8995e025940f1ed6d3b07c27923d9321ca9a42ead
Malware Config
Extracted
-
raccoon
-
fa72f4c1fbe65cee8651140fd47267ba
-
http://193.142.147.59:80
-
user_agent
Xmlst
Signatures
- Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
- Raccoon Stealer V2 payload 1 IoCs
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Patch.exe"C:\Users\Admin\AppData\Local\Temp\Patch.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WindowsServices\WindowsServices.exe"C:\Users\Admin\AppData\Roaming\WindowsServices\WindowsServices.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
WindowsServices.exe
memory/1720-1769-0x0000000000400000-0x0000000000418000-memory.dmp
memory/2436-665-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2436-666-0x0000000074B90000-0x0000000075340000-memory.dmp
memory/2436-667-0x0000000004DE0000-0x0000000004E7C000-memory.dmp
memory/2436-668-0x0000000074B90000-0x0000000075340000-memory.dmp
memory/4324-24-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-28-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-3-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-10-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-66-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-64-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-60-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-58-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-56-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-54-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-52-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-48-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-46-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-44-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-42-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-40-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-38-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-36-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-34-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-32-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-30-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-8-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-1-0x00000000001D0000-0x0000000000268000-memory.dmp
memory/4324-22-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-20-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-18-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-2-0x0000000005DC0000-0x0000000005E56000-memory.dmp
memory/4324-0-0x0000000074B9E000-0x0000000074B9F000-memory.dmp
memory/4324-16-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-6-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-62-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-50-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-4-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-26-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-12-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4324-656-0x0000000005F50000-0x0000000005FE2000-memory.dmp
memory/4324-655-0x0000000074B90000-0x0000000075340000-memory.dmp
memory/4324-657-0x0000000005E80000-0x0000000005EA2000-memory.dmp
memory/4324-658-0x0000000006090000-0x00000000063E4000-memory.dmp
memory/4324-659-0x0000000038890000-0x00000000388F6000-memory.dmp
memory/4324-660-0x0000000038CE0000-0x0000000038D72000-memory.dmp
memory/4324-661-0x0000000039330000-0x00000000398D4000-memory.dmp
memory/4324-664-0x0000000074B90000-0x0000000075340000-memory.dmp
memory/4324-14-0x0000000005DC0000-0x0000000005E4F000-memory.dmp
memory/4904-681-0x0000000074B90000-0x0000000075340000-memory.dmp
memory/4904-683-0x0000000074B90000-0x0000000075340000-memory.dmp
memory/4904-682-0x00000000056F0000-0x00000000056FA000-memory.dmp
memory/4904-680-0x0000000000D60000-0x0000000000E32000-memory.dmp
memory/4904-1761-0x0000000074B90000-0x0000000075340000-memory.dmp
memory/4904-1762-0x0000000008200000-0x0000000008236000-memory.dmp
memory/4904-1763-0x00000000082D0000-0x000000000831C000-memory.dmp
memory/4904-1770-0x0000000074B90000-0x0000000075340000-memory.dmp
memory/4904-684-0x0000000007FD0000-0x000000000808C000-memory.dmp