General

  • Target

    84352A722935CB115706CCE06D952ADF.exe

  • Size

    528KB

  • Sample

    210620-qtz165qvzj

  • MD5

    84352a722935cb115706cce06d952adf

  • SHA1

    68a49229dad70a1bc06db45747e4760c67440feb

  • SHA256

    b066989014bb1fa69020b9615b5d8074818ac1315eb541ff9e6a2711f0d5d7cb

  • SHA512

    dcd51bf74d171eeae32d63c155f393c2664ebde0819203d23612dffe6579d5f6bebcff390d8f323b04f4a7abe7fe6cc986ef49c3561eb16c584e3e22a51c4abc

Malware Config

Targets

    • Target

      84352A722935CB115706CCE06D952ADF.exe

    • Size

      528KB

    • MD5

      84352a722935cb115706cce06d952adf

    • SHA1

      68a49229dad70a1bc06db45747e4760c67440feb

    • SHA256

      b066989014bb1fa69020b9615b5d8074818ac1315eb541ff9e6a2711f0d5d7cb

    • SHA512

      dcd51bf74d171eeae32d63c155f393c2664ebde0819203d23612dffe6579d5f6bebcff390d8f323b04f4a7abe7fe6cc986ef49c3561eb16c584e3e22a51c4abc

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Downloads MZ/PE file

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks