raccoon | 54fd2d3eff97caa7dff88d9f1b8c79d650a88c4d7e64a99656ead19db5946b1a

Analysis

max time kernel
117s
max time network
119s
platform
windows10_x64
resource
win10v20210410
submitted
27/05/2021, 18:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ce75037e138d10403d71403b36201bc2.exe
Size 558KB
Sample210527-vsx5syft82
SHA256 54fd2d3eff97caa7dff88d9f1b8c79d650a88c4d7e64a99656ead19db5946b1a
MD5 ce75037e138d10403d71403b36201bc2
SHA1 5bc0d8cf265da5cfe6240b9b7863ae0f820f9f99
SHA512 c4cbf331b4ea714ef02f00e384e8177c482f29aa52b085f9f9868481798fe5d460227c33bae4fcbd344e484d7dc6d39751a7d8e9a3712fa5b22f09c591f67a5d
MD5 SHA1 SHA512

Score

10^/10

raccoon 7f6f1a71bebae5a113e0de986c62d83471cee5c8 discovery spyware stealer

Malware Config

Extracted

Family

raccoon

Botnet

7f6f1a71bebae5a113e0de986c62d83471cee5c8

Attributes

url4cnc
https://tttttt.me/baudemars

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Downloads MZ/PE file

Loads dropped DLL 1 IoCs

pid	Process
4008	ce75037e138d10403d71403b36201bc2.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3084	timeout.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 1320	4008	ce75037e138d10403d71403b36201bc2.exe	79
PID 4008 wrote to memory of 1320	4008	ce75037e138d10403d71403b36201bc2.exe	79
PID 4008 wrote to memory of 1320	4008	ce75037e138d10403d71403b36201bc2.exe	79
PID 1320 wrote to memory of 3084	1320	cmd.exe	81
PID 1320 wrote to memory of 3084	1320	cmd.exe	81
PID 1320 wrote to memory of 3084	1320	cmd.exe	81

C:\Users\Admin\AppData\Local\Temp\ce75037e138d10403d71403b36201bc2.exe
"C:\Users\Admin\AppData\Local\Temp\ce75037e138d10403d71403b36201bc2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\ce75037e138d10403d71403b36201bc2.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:3084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4008-114-0x00000000020F0000-0x0000000002181000-memory.dmp

Download

memory/4008-115-0x0000000000400000-0x0000000000494000-memory.dmp