Overview

overview

10

Static

static

bb88bf7c6d...07.exe

windows7_x64

1

bb88bf7c6d...07.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    bb88bf7c6da2f971c9adc22f4aa99807.exe
  • Size 770KB
  • Sample200624-le8hp2zhdn
  • SHA256 0c34d4763fc968ccbe9f33dec2ae9e3e132a61b40ffc93cc22f337a0758c0279
  • MD5 SHA1 SHA512
Score
10/10
raccoondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\LocalLow\machineinfo.txt

  • raccoon

Ransom Note
  • [Raccoon Stealer] - v1.5.11 Release Build compiled on Sat Jun 20 01:07:56 2020 Launched at: 2020.06.24 - 14:57:42 GMT Bot_ID: 664A9041-4AC4-46F3-B3DC-87DB4D57890E_Admin Running on a desktop =R=A=C=C=O=O=N= System Information: - System Language: English - System TimeZone: -0 hrs - IP: 154.61.71.51 - Location: 37.750999, -97.821999 | ?, ?, United States (?) - ComputerName: GOHCSFBB - Username: Admin - Windows version: NT 10.0 - Product name: Windows 10 Pro - System arch: x64 - CPU: Persocon Processor 2.5+ (2 cores) - RAM: 4095 MB (688 MB used) - Screen resolution: 1280x720 - Display devices: 0) Microsoft Basic Display Adapter ============

Targets

    • Target
      bb88bf7c6da2f971c9adc22f4aa99807.exe
    • Size 770KB
    • SHA256 0c34d4763fc968ccbe9f33dec2ae9e3e132a61b40ffc93cc22f337a0758c0279
    • MD5 SHA1 SHA512
    Score
    10/10
    ransomwarespywarediscoverystealerraccoon

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • Raccoon log file

      Detects a log file produced by the Raccoon Stealer.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spyware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Checks for installed software on the system

      discovery

    • Drops desktop.ini file(s)

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks