Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
05-07-2020 17:09
Static task
static1
Behavioral task
behavioral1
Sample
ca377ec6126ac459d77abd0a007b6a27.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
ca377ec6126ac459d77abd0a007b6a27.exe
Resource
win10
General
-
Target
ca377ec6126ac459d77abd0a007b6a27.exe
-
Size
486KB
-
MD5
ca377ec6126ac459d77abd0a007b6a27
-
SHA1
6cba52673af7df53d60852e96000f565d9fe2ede
-
SHA256
ad60a3f212003066341aee73c92b642a5a62933fd0dbabb813ce185fcf458222
-
SHA512
1729d37c12f4cb670a6ea456bead0bb6d42a42882b2da622b71600786f69dc189d71db9976bd977a8dedc459fc70607ebfada689430c203d9eb12d36ef9a56e9
Malware Config
Extracted
C:\Users\Admin\AppData\LocalLow\machineinfo.txt
raccoon
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Checks for installed software on the system 1 TTPs 30 IoCs
Processes:
ca377ec6126ac459d77abd0a007b6a27.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall ca377ec6126ac459d77abd0a007b6a27.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key opened \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall ca377ec6126ac459d77abd0a007b6a27.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName ca377ec6126ac459d77abd0a007b6a27.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall ca377ec6126ac459d77abd0a007b6a27.exe -
Loads dropped DLL 8 IoCs
Processes:
ca377ec6126ac459d77abd0a007b6a27.exepid process 1400 ca377ec6126ac459d77abd0a007b6a27.exe 1400 ca377ec6126ac459d77abd0a007b6a27.exe 1400 ca377ec6126ac459d77abd0a007b6a27.exe 1400 ca377ec6126ac459d77abd0a007b6a27.exe 1400 ca377ec6126ac459d77abd0a007b6a27.exe 1400 ca377ec6126ac459d77abd0a007b6a27.exe 1400 ca377ec6126ac459d77abd0a007b6a27.exe 1400 ca377ec6126ac459d77abd0a007b6a27.exe -
Raccoon log file 1 IoCs
Detects a log file produced by the Raccoon Stealer.
Processes:
yara_rule raccoon_log_file
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\mozglue.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\msvcp140.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\nss3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\softokn3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\vcruntime140.dll
-
\Users\Admin\AppData\LocalLow\sqlite3.dll
-
memory/1400-0-0x0000000000E08000-0x0000000000E19000-memory.dmpFilesize
68KB
-
memory/1400-1-0x00000000010E0000-0x00000000010F1000-memory.dmpFilesize
68KB