raccoon | f1202fc6dd5316b3532deee6847c5ef3ae472ad51fd764f64b03ebc8dc13c723

General

Target

2ad5f75c513d2c04d919089da447c26c.exe
Size

667KB
MD5

2ad5f75c513d2c04d919089da447c26c
SHA1

8d8ed7159184b38118333b036b1548722f8e3c62
SHA256

f1202fc6dd5316b3532deee6847c5ef3ae472ad51fd764f64b03ebc8dc13c723
SHA512

904fdbd15c703e2fd8a45e6680a1ae1693038a9508c3724886dd9d7b0c82743e16711ca2faf71622756626b52862aba99dfc7fc422d65c80e082ad032be24602

Score

10^/10

ransomware stealer raccoon spyware discovery

Malware Config

Extracted

Path

C:\Users\Admin\AppData\LocalLow\machineinfo.txt

Family

raccoon

Ransom Note

[Raccoon Stealer] - v1.5.11 Release Build compiled on Fri May 8 14:39:40 2020 Launched at: 2020.06.30 - 08:49:13 GMT Bot_ID: 664A9041-4AC4-46F3-B3DC-87DB4D57890E_Admin Running on a desktop =R=A=C=C=O=O=N= System Information: - System Language: English - System TimeZone: -0 hrs - IP: 154.61.71.51 - Location: 37.750999, -97.821999 | ?, ?, United States (?) - ComputerName: GOHCSFBB - Username: Admin - Windows version: NT 10.0 - Product name: Windows 10 Pro - System arch: x64 - CPU: Persocon Processor 2.5+ (2 cores) - RAM: 4095 MB (671 MB used) - Screen resolution: 1280x720 - Display devices: 0) Microsoft Basic Display Adapter ============

Signatures

Loads dropped DLL 8 IoCs

Processes:

2ad5f75c513d2c04d919089da447c26c.exe

pid	process
3100	2ad5f75c513d2c04d919089da447c26c.exe
3100	2ad5f75c513d2c04d919089da447c26c.exe
3100	2ad5f75c513d2c04d919089da447c26c.exe
3100	2ad5f75c513d2c04d919089da447c26c.exe
3100	2ad5f75c513d2c04d919089da447c26c.exe
3100	2ad5f75c513d2c04d919089da447c26c.exe
3100	2ad5f75c513d2c04d919089da447c26c.exe
3100	2ad5f75c513d2c04d919089da447c26c.exe

Raccoon log file 1 IoCs
Detects a log file produced by the Raccoon Stealer.

Processes:

yara_rule

raccoon_log_file

yara_rule
raccoon_log_file

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

2ad5f75c513d2c04d919089da447c26c.execmd.exe

description	pid	process	target process
PID 3100 wrote to memory of 1984	3100	2ad5f75c513d2c04d919089da447c26c.exe	cmd.exe
PID 3100 wrote to memory of 1984	3100	2ad5f75c513d2c04d919089da447c26c.exe	cmd.exe
PID 3100 wrote to memory of 1984	3100	2ad5f75c513d2c04d919089da447c26c.exe	cmd.exe
PID 1984 wrote to memory of 3040	1984	cmd.exe	timeout.exe
PID 1984 wrote to memory of 3040	1984	cmd.exe	timeout.exe
PID 1984 wrote to memory of 3040	1984	cmd.exe	timeout.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3040 timeout.exe
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3040	timeout.exe

Checks for installed software on the system 1 TTPs 31 IoCs

discovery

Query Registry

T1012

Processes:

2ad5f75c513d2c04d919089da447c26c.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe
Key opened	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	2ad5f75c513d2c04d919089da447c26c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall	2ad5f75c513d2c04d919089da447c26c.exe
Key enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall	2ad5f75c513d2c04d919089da447c26c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall	2ad5f75c513d2c04d919089da447c26c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName	2ad5f75c513d2c04d919089da447c26c.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\2ad5f75c513d2c04d919089da447c26c.exe
"C:\Users\Admin\AppData\Local\Temp\2ad5f75c513d2c04d919089da447c26c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Checks for installed software on the system
PID:3100

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\2ad5f75c513d2c04d919089da447c26c.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
3⤵
- Delays execution with timeout.exe
PID:3040

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll

Download Submit
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll

Download Submit
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll

Download Submit
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\mozglue.dll

Download Submit
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\nss3.dll

Download Submit
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\softokn3.dll

Download Submit
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\softokn3.dll

Download Submit
\Users\Admin\AppData\LocalLow\sqlite3.dll

Download Submit
memory/1984-10-0x0000000000000000-mapping.dmp

Download
memory/3040-11-0x0000000000000000-mapping.dmp

Download
memory/3100-0-0x0000000001D19000-0x0000000001D1A000-memory.dmp

Filesize
4KB

Download
memory/3100-1-0x0000000003A60000-0x0000000003A61000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads