raccoon | 9d03f0739a3840f5461af1d6ffa96a34c8a0df1b428b58825d95fe3a43a55d92

General

Target
E547317C7C8B33E16F2A0B23F7790915.exe
Size 1.4MB
Sample210601-amgwf462ls
SHA256 9d03f0739a3840f5461af1d6ffa96a34c8a0df1b428b58825d95fe3a43a55d92
MD5 e547317c7c8b33e16f2a0b23f7790915
SHA1 bebc66726f0c51243c789b7783893accf7734717
SHA512 66ae89c0d2c7543f9e071ef19e12f4ba9b9707fd5b475eac35be5b7fe7e0b286e75ba6ce01a610f3137db068895052da567254a069ec42e87411858c7ed3d6d3
MD5 SHA1 SHA512

Score

10^/10

raccoon 06394accf82ea147e8aaf9fad05193b7b0899411 stealer

Malware Config

Extracted

Family

raccoon

Botnet

06394accf82ea147e8aaf9fad05193b7b0899411

Attributes

url4cnc
https://tttttt.me/rino115sipsip

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1596 created 2052	1596	WerFault.exe	88

Executes dropped EXE 2 IoCs

pid	Process
2816	Riparo.exe.com
3168	Riparo.exe.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3168 set thread context of 2052	3168	Riparo.exe.com	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1596	2052	WerFault.exe	88

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
196	PING.EXE

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
3168	Riparo.exe.com
3168	Riparo.exe.com
3168	Riparo.exe.com
3168	Riparo.exe.com
3168	Riparo.exe.com
3168	Riparo.exe.com
3168	Riparo.exe.com
3168	Riparo.exe.com
3168	Riparo.exe.com
3168	Riparo.exe.com
3168	Riparo.exe.com
3168	Riparo.exe.com
3168	Riparo.exe.com
3168	Riparo.exe.com
3168	Riparo.exe.com
3168	Riparo.exe.com
3168	Riparo.exe.com
3168	Riparo.exe.com
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	1596	WerFault.exe
Token: SeBackupPrivilege	1596	WerFault.exe
Token: SeDebugPrivilege	1596	WerFault.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 3100	3724	E547317C7C8B33E16F2A0B23F7790915.exe	75
PID 3724 wrote to memory of 3100	3724	E547317C7C8B33E16F2A0B23F7790915.exe	75
PID 3724 wrote to memory of 3100	3724	E547317C7C8B33E16F2A0B23F7790915.exe	75
PID 3100 wrote to memory of 2728	3100	cmd.exe	77
PID 3100 wrote to memory of 2728	3100	cmd.exe	77
PID 3100 wrote to memory of 2728	3100	cmd.exe	77
PID 2728 wrote to memory of 1596	2728	cmd.exe	78
PID 2728 wrote to memory of 1596	2728	cmd.exe	78
PID 2728 wrote to memory of 1596	2728	cmd.exe	78
PID 2728 wrote to memory of 2816	2728	cmd.exe	79
PID 2728 wrote to memory of 2816	2728	cmd.exe	79
PID 2728 wrote to memory of 2816	2728	cmd.exe	79
PID 2728 wrote to memory of 196	2728	cmd.exe	81
PID 2728 wrote to memory of 196	2728	cmd.exe	81
PID 2728 wrote to memory of 196	2728	cmd.exe	81
PID 2816 wrote to memory of 3168	2816	Riparo.exe.com	82
PID 2816 wrote to memory of 3168	2816	Riparo.exe.com	82
PID 2816 wrote to memory of 3168	2816	Riparo.exe.com	82
PID 3724 wrote to memory of 1724	3724	E547317C7C8B33E16F2A0B23F7790915.exe	86
PID 3724 wrote to memory of 1724	3724	E547317C7C8B33E16F2A0B23F7790915.exe	86
PID 3724 wrote to memory of 1724	3724	E547317C7C8B33E16F2A0B23F7790915.exe	86
PID 3168 wrote to memory of 2052	3168	Riparo.exe.com	88
PID 3168 wrote to memory of 2052	3168	Riparo.exe.com	88
PID 3168 wrote to memory of 2052	3168	Riparo.exe.com	88
PID 3168 wrote to memory of 2052	3168	Riparo.exe.com	88
PID 3168 wrote to memory of 2052	3168	Riparo.exe.com	88

C:\Users\Admin\AppData\Local\Temp\E547317C7C8B33E16F2A0B23F7790915.exe
"C:\Users\Admin\AppData\Local\Temp\E547317C7C8B33E16F2A0B23F7790915.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\cmd < Fosse.wks
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^wuTvquXbVEKgFRdRiefYnDoXuYElhRMHnFjATKqGlxVIlLzUWcURCZFbXVdeBNlrRrQqFPXveJOtHmMxEKgSX$" Intendeva.wks
      4⤵
      PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Riparo.exe.com
      Riparo.exe.com S
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Riparo.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Riparo.exe.com S
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3168
      - C:\Windows\SysWOW64\nslookup.exe
        
        C:\Windows\SysWOW64\nslookup.exe
        6⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 516
        7⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1596
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 30
      4⤵
      Runs ping.exe
      PID:196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
  2⤵
  PID:1724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2052-130-0x0000000002D60000-0x0000000002DF2000-memory.dmp

Download

memory/3168-129-0x0000000000F50000-0x0000000000F51000-memory.dmp