raccoon | 9d98cf2a209bc4ccc92b7dc792c6f3b21c0ce1c2f7eb72498823e7a593145fea

General

Target
7ccbf76d23c03de983a9beaf7672768b.exe
Size 551KB
Sample210526-hmntntbshs
SHA256 9d98cf2a209bc4ccc92b7dc792c6f3b21c0ce1c2f7eb72498823e7a593145fea
MD5 7ccbf76d23c03de983a9beaf7672768b
SHA1 ddf5d83a2a46068ed3287d8b9aa0e30c76bfde76
SHA512 349416beb35eea034ad665d2450741a9fa6dfe5e0677c243276093581f1823873e9580459ee38bf908c9dc857aaafdc6b7ff4a32fb30540f29df6cebbc650a8a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Attributes

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
3776	oEkHiw0AgY.exe
2872	sqlcmd.exe

Loads dropped DLL 1 IoCs

pid	Process
3892	7ccbf76d23c03de983a9beaf7672768b.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1088	schtasks.exe
3788	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1808	timeout.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 3776	3892	7ccbf76d23c03de983a9beaf7672768b.exe	79
PID 3892 wrote to memory of 3776	3892	7ccbf76d23c03de983a9beaf7672768b.exe	79
PID 3892 wrote to memory of 3776	3892	7ccbf76d23c03de983a9beaf7672768b.exe	79
PID 3892 wrote to memory of 3496	3892	7ccbf76d23c03de983a9beaf7672768b.exe	80
PID 3892 wrote to memory of 3496	3892	7ccbf76d23c03de983a9beaf7672768b.exe	80
PID 3892 wrote to memory of 3496	3892	7ccbf76d23c03de983a9beaf7672768b.exe	80
PID 3496 wrote to memory of 1808	3496	cmd.exe	82
PID 3496 wrote to memory of 1808	3496	cmd.exe	82
PID 3496 wrote to memory of 1808	3496	cmd.exe	82
PID 3776 wrote to memory of 1088	3776	oEkHiw0AgY.exe	83
PID 3776 wrote to memory of 1088	3776	oEkHiw0AgY.exe	83
PID 3776 wrote to memory of 1088	3776	oEkHiw0AgY.exe	83
PID 2872 wrote to memory of 3788	2872	sqlcmd.exe	86
PID 2872 wrote to memory of 3788	2872	sqlcmd.exe	86
PID 2872 wrote to memory of 3788	2872	sqlcmd.exe	86

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
  2⤵
  - Creates scheduled task(s)
  PID:3788