raccoon | cc7e09f135b6cb09c0a32d54beb24789a94a5ccec038a038ad2ddaeedb697ef0

General

Target
cc7e09f135b6cb09c0a32d54beb24789a94a5ccec038a.exe
Size 338KB
Sample210902-a6arbmg5mj
SHA256 cc7e09f135b6cb09c0a32d54beb24789a94a5ccec038a038ad2ddaeedb697ef0
MD5 877f963ffc32a7b22d0d57c687eba65c
SHA1 65508d8a5b576eb4f884e756cb817e9512a2940f
SHA512 ac9fe4ffa3d584687647acdb95fad970cbea4098995f3b52cdbbb4c46a58fb163c07f1db3e02dbf36bf1e834ae3e561ec83172d030bca1edfed178c2142e0aee
MD5 SHA1 SHA512

Score

10^/10

raccoon 6e76410dbdf2085ebcf2777560bd8cb0790329c9 discovery spyware stealer

Malware Config

Extracted

Family

raccoon

Botnet

6e76410dbdf2085ebcf2777560bd8cb0790329c9

Attributes

url4cnc
https://telete.in/bibiOutriggr1

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1304	1484894427.exe

Loads dropped DLL 5 IoCs

pid	Process
1304	1484894427.exe
1304	1484894427.exe
1304	1484894427.exe
1304	1484894427.exe
1304	1484894427.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	freegeoip.app
24	freegeoip.app
25	freegeoip.app
27	freegeoip.app

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2364	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3332	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3332	taskkill.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 3332	3548	cc7e09f135b6cb09c0a32d54beb24789a94a5ccec038a.exe	76
PID 3548 wrote to memory of 3332	3548	cc7e09f135b6cb09c0a32d54beb24789a94a5ccec038a.exe	76
PID 3548 wrote to memory of 3332	3548	cc7e09f135b6cb09c0a32d54beb24789a94a5ccec038a.exe	76
PID 3332 wrote to memory of 1304	3332	cmd.exe	78
PID 3332 wrote to memory of 1304	3332	cmd.exe	78
PID 3332 wrote to memory of 1304	3332	cmd.exe	78
PID 1304 wrote to memory of 1752	1304	1484894427.exe	79
PID 1304 wrote to memory of 1752	1304	1484894427.exe	79
PID 1304 wrote to memory of 1752	1304	1484894427.exe	79
PID 1752 wrote to memory of 2364	1752	cmd.exe	81
PID 1752 wrote to memory of 2364	1752	cmd.exe	81
PID 1752 wrote to memory of 2364	1752	cmd.exe	81
PID 3548 wrote to memory of 2608	3548	cc7e09f135b6cb09c0a32d54beb24789a94a5ccec038a.exe	82
PID 3548 wrote to memory of 2608	3548	cc7e09f135b6cb09c0a32d54beb24789a94a5ccec038a.exe	82
PID 3548 wrote to memory of 2608	3548	cc7e09f135b6cb09c0a32d54beb24789a94a5ccec038a.exe	82
PID 2608 wrote to memory of 3332	2608	cmd.exe	84
PID 2608 wrote to memory of 3332	2608	cmd.exe	84
PID 2608 wrote to memory of 3332	2608	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\cc7e09f135b6cb09c0a32d54beb24789a94a5ccec038a.exe
"C:\Users\Admin\AppData\Local\Temp\cc7e09f135b6cb09c0a32d54beb24789a94a5ccec038a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\1484894427.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Users\Admin\AppData\Local\Temp\1484894427.exe
    "C:\Users\Admin\AppData\Local\Temp\1484894427.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\1484894427.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1752
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 10 /NOBREAK
        5⤵
        Delays execution with timeout.exe
        
        PID:2364
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "cc7e09f135b6cb09c0a32d54beb24789a94a5ccec038a.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\cc7e09f135b6cb09c0a32d54beb24789a94a5ccec038a.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "cc7e09f135b6cb09c0a32d54beb24789a94a5ccec038a.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3332