raccoon | 4d056b87049ec7fce672b40190bf8b5f9185395b7313d05bc196a655e7fe0c7a

General

Target

system32.bin.exe
Size

465KB
MD5

049ef18418affcd542d9aa545bb07ee3
SHA1

994b2b316ed112d81c697294405dcf15f9193deb
SHA256

4d056b87049ec7fce672b40190bf8b5f9185395b7313d05bc196a655e7fe0c7a
SHA512

ad0b3ab61327d0cc802d3512db80a60be264a52b8f0f750c9d83b4750d1373c59466d399da8650523d6e99723d75e962176ece9f669310f464844c5c2370886c

Score

10^/10

stealer raccoon persistence

Malware Config

Extracted

Family

raccoon

Attributes

url4cnc

rc4.plain

Extracted

Family

raccoon

Botnet

b240f186dfcd9a0141345e239b4ac51800830ac0

Attributes

url4cnc
https://drive.google.com/uc?export=download&id=19HMmBPaIPyhdlvzB7YPOENIFHwLz8Kkc

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Blacklisted process makes network request 1 IoCs

Processes:

cmd.exe

flow pid process

5 1696 cmd.exe
Loads dropped DLL 2 IoCs

Processes:

system32.bin.exe

pid process

1592 system32.bin.exe
1592 system32.bin.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Modifies service 2 TTPs 1 IoCs
persistence

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

system32.bin.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\TcpWindowSize = "64240" system32.bin.exe
Drops file in Windows directory 2 IoCs

Processes:

system32.bin.execmd.exe

description ioc process

File opened for modification C:\Windows\win.ini system32.bin.exe
File created C:\Windows\Tasks\System32.job cmd.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1552 1696 WerFault.exe cmd.exe

flow	pid	process
5	1696	cmd.exe

pid	process
1592	system32.bin.exe
1592	system32.bin.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\TcpWindowSize = "64240"	system32.bin.exe

description	ioc	process
File opened for modification	C:\Windows\win.ini	system32.bin.exe
File created	C:\Windows\Tasks\System32.job	cmd.exe

pid	pid_target	process	target process
1552	1696	WerFault.exe	cmd.exe

Modifies registry class 2 IoCs

Processes:

system32.bin.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioCD\shell\PlayWithVLC\command	system32.bin.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioCD\shell\PlayWithVLC	system32.bin.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

system32.bin.exeWerFault.exe

pid process

1592 system32.bin.exe
1552 WerFault.exe
1552 WerFault.exe
1552 WerFault.exe
1552 WerFault.exe
1552 WerFault.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

system32.bin.exe

pid process

1592 system32.bin.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1552 WerFault.exe

pid	process
1592	system32.bin.exe
1552	WerFault.exe
1552	WerFault.exe
1552	WerFault.exe
1552	WerFault.exe
1552	WerFault.exe

pid	process
1592	system32.bin.exe

description	pid	process
Token: SeDebugPrivilege	1552	WerFault.exe

Suspicious use of WriteProcessMemory 57 IoCs

Processes:

system32.bin.exeDllHost.execmd.execmd.exe

description	pid	process	target process
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1592 wrote to memory of 1696	1592	system32.bin.exe	cmd.exe
PID 1980 wrote to memory of 1128	1980	DllHost.exe	cmd.exe
PID 1980 wrote to memory of 1128	1980	DllHost.exe	cmd.exe
PID 1980 wrote to memory of 1128	1980	DllHost.exe	cmd.exe
PID 1980 wrote to memory of 1128	1980	DllHost.exe	cmd.exe
PID 1128 wrote to memory of 1320	1128	cmd.exe	reg.exe
PID 1128 wrote to memory of 1320	1128	cmd.exe	reg.exe
PID 1128 wrote to memory of 1320	1128	cmd.exe	reg.exe
PID 1696 wrote to memory of 1552	1696	cmd.exe	WerFault.exe
PID 1696 wrote to memory of 1552	1696	cmd.exe	WerFault.exe
PID 1696 wrote to memory of 1552	1696	cmd.exe	WerFault.exe
PID 1696 wrote to memory of 1552	1696	cmd.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\system32.bin.exe
"C:\Users\Admin\AppData\Local\Temp\system32.bin.exe"
1⤵
- Loads dropped DLL
- Modifies service
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1592

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Blacklisted process makes network request
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 688
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1552

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
1⤵
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat" /t REG_DWORD /d 0"
2⤵
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\system32\reg.exe
reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat" /t REG_DWORD /d 0
3⤵
PID:1320

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\etchings.dll
MD5
9aba0224ea651e03776eb21671f8a743

SHA1
87aa10ba47a85b2124bf77d00182d714d9cfb233

SHA256
51c3bfd80d36a77b97d643dbc66d2b6a3662e5316d7ba357431d562f96977725

SHA512
8c80d045fa4f7362fa3c31c7515d2464a32eb2685bd8d05d156e177d56d1ac703f950f35f138914f5800fdd305ef8388a804039a510628716f2cb3252ab7a239

Download Submit
\Users\Admin\AppData\Local\Temp\nss4D85.tmp\System.dll
MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
memory/1128-6-0x0000000000000000-mapping.dmp

Download
memory/1320-7-0x0000000000000000-mapping.dmp

Download
memory/1552-10-0x0000000001F70000-0x0000000001F81000-memory.dmp

Filesize
68KB

Download
memory/1552-19-0x00000000027E0000-0x00000000027F1000-memory.dmp

Filesize
68KB

Download
memory/1552-8-0x0000000000000000-mapping.dmp

Download
memory/1552-9-0x0000000001F70000-0x0000000001F81000-memory.dmp

Filesize
68KB

Download
memory/1592-2-0x00000000003E0000-0x00000000003F1000-memory.dmp

Filesize
68KB

Download
memory/1592-3-0x00000000028D0000-0x0000000002955000-memory.dmp

Filesize
532KB

Download
memory/1696-4-0x0000000000000000-mapping.dmp

Download
memory/1696-12-0x0000000000000000-mapping.dmp

Download
memory/1696-13-0x0000000000000000-mapping.dmp

Download
memory/1696-14-0x0000000000000000-mapping.dmp

Download
memory/1696-15-0x0000000000000000-mapping.dmp

Download
memory/1696-16-0x0000000000000000-mapping.dmp

Download
memory/1696-17-0x0000000000000000-mapping.dmp

Download
memory/1696-18-0x0000000000000000-mapping.dmp

Download
memory/1696-5-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads