Overview

overview

10

Static

static

COO_TPE026...41.scr

windows7_x64

10

COO_TPE026...41.scr

windows10_x64

10

Analysis

  • max time kernel
    77s
  • max time network
    66s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    06/01/2021, 07:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    COO_TPE0269320_image2020-12-31-055841.scr
  • Size 1.0MB
  • Sample210106-xkn7r4qehs
  • SHA256 7432ea3b561da4e75f3e81b511b0a2b4d9f9d63e293fd1babd22b20c1b27db3c
  • MD5 SHA1 SHA512
Score
10/10
raccoondiscoveryspywarestealer

Malware Config

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon
  • Deletes itself 1 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spyware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • JavaScript code in executable 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\COO_TPE0269320_image2020-12-31-055841.scr
    "C:\Users\Admin\AppData\Local\Temp\COO_TPE0269320_image2020-12-31-055841.scr" /S
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Users\Admin\AppData\Local\Temp\COO_TPE0269320_image2020-12-31-055841.scr
      "C:\Users\Admin\AppData\Local\Temp\COO_TPE0269320_image2020-12-31-055841.scr"
      2⤵
        PID:1452
      • C:\Users\Admin\AppData\Local\Temp\COO_TPE0269320_image2020-12-31-055841.scr
        "C:\Users\Admin\AppData\Local\Temp\COO_TPE0269320_image2020-12-31-055841.scr"
        2⤵
          PID:1084
        • C:\Users\Admin\AppData\Local\Temp\COO_TPE0269320_image2020-12-31-055841.scr
          "C:\Users\Admin\AppData\Local\Temp\COO_TPE0269320_image2020-12-31-055841.scr"
          2⤵
          • Loads dropped DLL
          • Modifies system certificate store
          • Suspicious use of WriteProcessMemory
          PID:1444
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\COO_TPE0269320_image2020-12-31-055841.scr"
            3⤵
            • Deletes itself
            • Suspicious use of WriteProcessMemory
            PID:1580
            • C:\Windows\SysWOW64\timeout.exe
              timeout /T 10 /NOBREAK
              4⤵
              • Delays execution with timeout.exe
              PID:1492

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/904-12-0x000007FEF81B0000-0x000007FEF842A000-memory.dmp
            Download

            memory/1444-10-0x0000000000400000-0x0000000000494000-memory.dmp
            Download

            memory/1444-8-0x0000000000400000-0x0000000000494000-memory.dmp
            Download

            memory/1680-2-0x0000000074450000-0x0000000074B3E000-memory.dmp
            Download

            memory/1680-7-0x0000000005790000-0x0000000005824000-memory.dmp
            Download

            memory/1680-6-0x0000000005500000-0x00000000055B5000-memory.dmp
            Download

            memory/1680-5-0x0000000000620000-0x0000000000632000-memory.dmp
            Download

            memory/1680-3-0x00000000001E0000-0x00000000001E1000-memory.dmp
            Download