raccoon | 3eb7ffbfa401fcfac54abc23f156c158739984ef654d8bd5af105ef6b78f8a42

Analysis

max time kernel
58s
max time network
115s
platform
windows10_x64
resource
win10v20210408
submitted
30/08/2021, 09:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3eb7ffbfa401fcfac54abc23f156c158739984ef654d8.exe
Size 339KB
Sample210830-rdj4wsfske
SHA256 3eb7ffbfa401fcfac54abc23f156c158739984ef654d8bd5af105ef6b78f8a42
MD5 51cd6bc2c4974329c1bba928b93522b3
SHA1 ffdbf608ac51f1e73e928e3489e1f99fe2f72537
SHA512 20762d9cc66d6392df57c840d32f7ede52f8fe7e971080004aa108c894a9bf3185b44b3949a5da18e0d7cfb25903a60c64e6a0c1aaca46f55b1ad091683be50c
MD5 SHA1 SHA512

Score

10^/10

raccoon 6e76410dbdf2085ebcf2777560bd8cb0790329c9 spyware stealer

Malware Config

Extracted

Family

raccoon

Botnet

6e76410dbdf2085ebcf2777560bd8cb0790329c9

Attributes

url4cnc
https://telete.in/bibiOutriggr1

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3452 created 2344	3452	WerFault.exe	89

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
2344	1944089079.exe

Loads dropped DLL 1 IoCs

pid	Process
2344	1944089079.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	freegeoip.app
26	freegeoip.app
21	freegeoip.app
23	freegeoip.app

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 24 IoCs

pid	pid_target	Process	procid_target
2860	628	WerFault.exe	67
1956	628	WerFault.exe	67
1324	628	WerFault.exe	67
1320	628	WerFault.exe	67
3716	628	WerFault.exe	67
2100	628	WerFault.exe	67
2264	628	WerFault.exe	67
4048	628	WerFault.exe	67
1488	628	WerFault.exe	67
2172	2344	WerFault.exe	89
3792	2344	WerFault.exe	89
3916	2344	WerFault.exe	89
492	2344	WerFault.exe	89
816	2344	WerFault.exe	89
3960	2344	WerFault.exe	89
1976	2344	WerFault.exe	89
2224	2344	WerFault.exe	89
3620	2344	WerFault.exe	89
2252	2344	WerFault.exe	89
1508	2344	WerFault.exe	89
3068	2344	WerFault.exe	89
2664	2344	WerFault.exe	89
3452	2344	WerFault.exe	89
2796	628	WerFault.exe	67

Kills process with taskkill 1 IoCs

evasion

pid	Process
3964	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2860	WerFault.exe
2860	WerFault.exe
2860	WerFault.exe
2860	WerFault.exe
2860	WerFault.exe
2860	WerFault.exe
2860	WerFault.exe
2860	WerFault.exe
2860	WerFault.exe
2860	WerFault.exe
2860	WerFault.exe
2860	WerFault.exe
2860	WerFault.exe
2860	WerFault.exe
1956	WerFault.exe
1956	WerFault.exe
1956	WerFault.exe
1956	WerFault.exe
1956	WerFault.exe
1956	WerFault.exe
1956	WerFault.exe
1956	WerFault.exe
1956	WerFault.exe
1956	WerFault.exe
1956	WerFault.exe
1956	WerFault.exe
1956	WerFault.exe
1956	WerFault.exe
1324	WerFault.exe
1324	WerFault.exe
1324	WerFault.exe
1324	WerFault.exe
1324	WerFault.exe
1324	WerFault.exe
1324	WerFault.exe
1324	WerFault.exe
1324	WerFault.exe
1324	WerFault.exe
1324	WerFault.exe
1324	WerFault.exe
1324	WerFault.exe
1324	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
3716	WerFault.exe
3716	WerFault.exe
3716	WerFault.exe
3716	WerFault.exe
3716	WerFault.exe
3716	WerFault.exe
3716	WerFault.exe
3716	WerFault.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeRestorePrivilege	2860	WerFault.exe
Token: SeBackupPrivilege	2860	WerFault.exe
Token: SeDebugPrivilege	2860	WerFault.exe
Token: SeDebugPrivilege	1956	WerFault.exe
Token: SeDebugPrivilege	1324	WerFault.exe
Token: SeDebugPrivilege	1320	WerFault.exe
Token: SeDebugPrivilege	3716	WerFault.exe
Token: SeDebugPrivilege	2100	WerFault.exe
Token: SeDebugPrivilege	2264	WerFault.exe
Token: SeDebugPrivilege	4048	WerFault.exe
Token: SeDebugPrivilege	1488	WerFault.exe
Token: SeDebugPrivilege	2172	WerFault.exe
Token: SeDebugPrivilege	3792	WerFault.exe
Token: SeDebugPrivilege	3916	WerFault.exe
Token: SeDebugPrivilege	492	WerFault.exe
Token: SeDebugPrivilege	816	WerFault.exe
Token: SeDebugPrivilege	3960	WerFault.exe
Token: SeDebugPrivilege	1976	WerFault.exe
Token: SeDebugPrivilege	2224	WerFault.exe
Token: SeDebugPrivilege	3620	WerFault.exe
Token: SeDebugPrivilege	2252	WerFault.exe
Token: SeDebugPrivilege	1508	WerFault.exe
Token: SeDebugPrivilege	3068	WerFault.exe
Token: SeDebugPrivilege	2664	WerFault.exe
Token: SeDebugPrivilege	3452	WerFault.exe
Token: SeDebugPrivilege	2796	WerFault.exe
Token: SeDebugPrivilege	3964	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 976	628	3eb7ffbfa401fcfac54abc23f156c158739984ef654d8.exe	87
PID 628 wrote to memory of 976	628	3eb7ffbfa401fcfac54abc23f156c158739984ef654d8.exe	87
PID 628 wrote to memory of 976	628	3eb7ffbfa401fcfac54abc23f156c158739984ef654d8.exe	87
PID 976 wrote to memory of 2344	976	cmd.exe	89
PID 976 wrote to memory of 2344	976	cmd.exe	89
PID 976 wrote to memory of 2344	976	cmd.exe	89
PID 628 wrote to memory of 1488	628	3eb7ffbfa401fcfac54abc23f156c158739984ef654d8.exe	106
PID 628 wrote to memory of 1488	628	3eb7ffbfa401fcfac54abc23f156c158739984ef654d8.exe	106
PID 628 wrote to memory of 1488	628	3eb7ffbfa401fcfac54abc23f156c158739984ef654d8.exe	106
PID 1488 wrote to memory of 3964	1488	cmd.exe	108
PID 1488 wrote to memory of 3964	1488	cmd.exe	108
PID 1488 wrote to memory of 3964	1488	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\3eb7ffbfa401fcfac54abc23f156c158739984ef654d8.exe
"C:\Users\Admin\AppData\Local\Temp\3eb7ffbfa401fcfac54abc23f156c158739984ef654d8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 776
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 824
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 844
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 880
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 984
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 1124
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 1164
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 1352
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:4048
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\1944089079.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:976
- - C:\Users\Admin\AppData\Local\Temp\1944089079.exe
    "C:\Users\Admin\AppData\Local\Temp\1944089079.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2344
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 748
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:2172
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 760
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:3792
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 764
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:3916
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 900
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:492
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 1200
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:816
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 1212
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:3960
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 1260
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:1976
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 1160
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:2224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 1276
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:3620
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 1284
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:2252
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 1344
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:1508
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 1420
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:3068
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 1320
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:2664
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 1288
      4⤵
      Suspicious use of NtCreateProcessExOtherParentProcess
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:3452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 1744
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 1760
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2796
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "3eb7ffbfa401fcfac54abc23f156c158739984ef654d8.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\3eb7ffbfa401fcfac54abc23f156c158739984ef654d8.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "3eb7ffbfa401fcfac54abc23f156c158739984ef654d8.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/628-115-0x0000000000400000-0x0000000001DA2000-memory.dmp

Download

memory/628-114-0x0000000003AD0000-0x0000000003B1A000-memory.dmp

Download

memory/2344-120-0x0000000003A00000-0x0000000003A8F000-memory.dmp

Download

memory/2344-121-0x0000000000400000-0x0000000001DC8000-memory.dmp

Download