General

  • Target

    1be37486fd870c33386afe4e39f9edea.exe

  • Size

    515KB

  • Sample

    210129-s9mqn7571a

  • MD5

    1be37486fd870c33386afe4e39f9edea

  • SHA1

    d3005dcb1d7ba10744cd6f0eb4a736e46895b7f8

  • SHA256

    77f471b2f588c31126527e4a0e58dd383f9790917276651d1bddd29e519f2e4b

  • SHA512

    21a0ce7e1bb9b99874cc475b92ac19fe38f9005d012cd75f54e45994d625300924534b099b1a70f9a5a62e7e65de033a7dab3f28a1e3fd4d927eee52c45b5994

Malware Config

Targets

    • Target

      1be37486fd870c33386afe4e39f9edea.exe

    • Size

      515KB

    • MD5

      1be37486fd870c33386afe4e39f9edea

    • SHA1

      d3005dcb1d7ba10744cd6f0eb4a736e46895b7f8

    • SHA256

      77f471b2f588c31126527e4a0e58dd383f9790917276651d1bddd29e519f2e4b

    • SHA512

      21a0ce7e1bb9b99874cc475b92ac19fe38f9005d012cd75f54e45994d625300924534b099b1a70f9a5a62e7e65de033a7dab3f28a1e3fd4d927eee52c45b5994

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • JavaScript code in executable

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks