raccoon | 2cdf554c536e1d38490814b0b7961657cd2b2ea11989e25b3208a5b4776702e0

General

Target
480d202bd37a16d5bcc03d410e2384e4.exe
Size 582KB
Sample210601-zlamv9db2e
SHA256 2cdf554c536e1d38490814b0b7961657cd2b2ea11989e25b3208a5b4776702e0
MD5 480d202bd37a16d5bcc03d410e2384e4
SHA1 85f8b1c22e943ddf78a7ed347ddc894581a50dd0
SHA512 be872abdc1d717c8a170746689d2aa4588c7fd8c602206a7fc87092578b508a0fc5c68f754f76516e4563491543976a217c0f013f35a7c19a732adffcf473061
MD5 SHA1 SHA512

Score

10^/10

raccoon a5cce470ad0d57aff9fa94b5ee2c0c1fc2d802af discovery spyware stealer

Malware Config

Extracted

Family

raccoon

Botnet

a5cce470ad0d57aff9fa94b5ee2c0c1fc2d802af

Attributes

url4cnc
https://tttttt.me/baudemars

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
336	teNbqPG71l.exe
1728	sqlcmd.exe

Deletes itself 1 IoCs

pid	Process
640	cmd.exe

Loads dropped DLL 9 IoCs

pid	Process
1100	480d202bd37a16d5bcc03d410e2384e4.exe
1100	480d202bd37a16d5bcc03d410e2384e4.exe
1100	480d202bd37a16d5bcc03d410e2384e4.exe
1100	480d202bd37a16d5bcc03d410e2384e4.exe
1100	480d202bd37a16d5bcc03d410e2384e4.exe
1100	480d202bd37a16d5bcc03d410e2384e4.exe
1100	480d202bd37a16d5bcc03d410e2384e4.exe
1100	480d202bd37a16d5bcc03d410e2384e4.exe
1100	480d202bd37a16d5bcc03d410e2384e4.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
320	schtasks.exe
1616	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1348	timeout.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	480d202bd37a16d5bcc03d410e2384e4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	480d202bd37a16d5bcc03d410e2384e4.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 336	1100	480d202bd37a16d5bcc03d410e2384e4.exe	30
PID 1100 wrote to memory of 336	1100	480d202bd37a16d5bcc03d410e2384e4.exe	30
PID 1100 wrote to memory of 336	1100	480d202bd37a16d5bcc03d410e2384e4.exe	30
PID 1100 wrote to memory of 336	1100	480d202bd37a16d5bcc03d410e2384e4.exe	30
PID 1100 wrote to memory of 640	1100	480d202bd37a16d5bcc03d410e2384e4.exe	31
PID 1100 wrote to memory of 640	1100	480d202bd37a16d5bcc03d410e2384e4.exe	31
PID 1100 wrote to memory of 640	1100	480d202bd37a16d5bcc03d410e2384e4.exe	31
PID 1100 wrote to memory of 640	1100	480d202bd37a16d5bcc03d410e2384e4.exe	31
PID 640 wrote to memory of 1348	640	cmd.exe	33
PID 640 wrote to memory of 1348	640	cmd.exe	33
PID 640 wrote to memory of 1348	640	cmd.exe	33
PID 640 wrote to memory of 1348	640	cmd.exe	33
PID 336 wrote to memory of 320	336	teNbqPG71l.exe	34
PID 336 wrote to memory of 320	336	teNbqPG71l.exe	34
PID 336 wrote to memory of 320	336	teNbqPG71l.exe	34
PID 336 wrote to memory of 320	336	teNbqPG71l.exe	34
PID 1928 wrote to memory of 1728	1928	taskeng.exe	37
PID 1928 wrote to memory of 1728	1928	taskeng.exe	37
PID 1928 wrote to memory of 1728	1928	taskeng.exe	37
PID 1928 wrote to memory of 1728	1928	taskeng.exe	37
PID 1728 wrote to memory of 1616	1728	sqlcmd.exe	38
PID 1728 wrote to memory of 1616	1728	sqlcmd.exe	38
PID 1728 wrote to memory of 1616	1728	sqlcmd.exe	38
PID 1728 wrote to memory of 1616	1728	sqlcmd.exe	38

C:\Users\Admin\AppData\Local\Temp\480d202bd37a16d5bcc03d410e2384e4.exe
"C:\Users\Admin\AppData\Local\Temp\480d202bd37a16d5bcc03d410e2384e4.exe"
1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Users\Admin\AppData\Local\Temp\teNbqPG71l.exe
  "C:\Users\Admin\AppData\Local\Temp\teNbqPG71l.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:336
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
    3⤵
    - Creates scheduled task(s)
    PID:320
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\480d202bd37a16d5bcc03d410e2384e4.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:1348

C:\Windows\system32\taskeng.exe
taskeng.exe {2402FDA5-0973-4848-AB6C-D8627A4FA116} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
    3⤵
    - Creates scheduled task(s)
    PID:1616