raccoon | 2326642c8066a03b5d094d54c6d592550b5ab633c16d45d1c6725459a17b1f68

Resubmissions

07-02-2025 20:14

250207-yz6xjsxkek 10

07-02-2025 12:14

250207-peccrs1nek 10

07-02-2025 12:06

250207-n914ya1mbp 3

Analysis

max time kernel
150s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20250207-en
resource tags

arch:x64arch:x86image:win11-20250207-enlocale:en-usos:windows11-21h2-x64system
submitted
07-02-2025 20:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Webroot SecureAnywhere Antivirus v.9.0.31.34.exe
Size

902.4MB
MD5

ab9f630ff850353ae47deb30ef641a65
SHA1

3998b45efac53903deb318549fc9575f2b04fbf7
SHA256

2326642c8066a03b5d094d54c6d592550b5ab633c16d45d1c6725459a17b1f68
SHA512

217032a4677bd8b0dd0ef671f0e491f3bd25ada1c3fda39bdfd992696c5a1ef608844aa82aad6dd70189000465b4b94762421068d5f51d915056ebccb67367aa
SSDEEP

6144:sh/OEwQk1HVvEpUL150OsFWs4C29dqKvBy+dQBgch:s3wQkzvE65GOC/v2BM

Score

10^/10

raccoon f2dbcb9d18b96f7f026294ef43835a06 discovery stealer

Malware Config

Extracted

Family

raccoon

Botnet

f2dbcb9d18b96f7f026294ef43835a06

http://91.103.252.231:80/

Attributes

user_agent
Xmlst

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/2172-0-0x0000000000400000-0x0000000000417000-memory.dmp	family_raccoon_v2
behavioral1/memory/2172-1-0x0000000000400000-0x0000000000417000-memory.dmp	family_raccoon_v2

Raccoon family
raccoon

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Webroot SecureAnywhere Antivirus v.9.0.31.34.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4960	MicrosoftEdgeUpdate.exe
4960	MicrosoftEdgeUpdate.exe
4960	MicrosoftEdgeUpdate.exe
4960	MicrosoftEdgeUpdate.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4960	MicrosoftEdgeUpdate.exe

C:\Users\Admin\AppData\Local\Temp\Webroot SecureAnywhere Antivirus v.9.0.31.34.exe
"C:\Users\Admin\AppData\Local\Temp\Webroot SecureAnywhere Antivirus v.9.0.31.34.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=5232,i,15410088440223900913,7012910745851198436,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
1⤵
PID:3064

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5276,i,15410088440223900913,7012910745851198436,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:14
1⤵
PID:2064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=4524,i,15410088440223900913,7012910745851198436,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
1⤵
PID:4580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2172-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2172-1-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download