raccoon | e97f71d3020b3cf4c3d22ebe380a902fddc0e5ce666cc1b0059efe8e67860a72

General

Target
DD82037FFC85850A40B6C6561EF03ECB.exe
Size 5.2MB
Sample210906-11m7yabec2
SHA256 e97f71d3020b3cf4c3d22ebe380a902fddc0e5ce666cc1b0059efe8e67860a72
MD5 dd82037ffc85850a40b6c6561ef03ecb
SHA1 5e6078e228d3e53ffa6784609c0080bb9c48ae88
SHA512 dbb5029d2dafbec96ff39a2fa3eda85d2c58902e3fec0886b69f2b60a7571d360ac334aa76ce68638aa2d293883952b1b2afd07d1493e06e320f174a13564b18
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Attributes

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
432	tPtOelFwqI.exe
1748	sihost.exe

Deletes itself 1 IoCs

pid	Process
1360	cmd.exe

Loads dropped DLL 8 IoCs

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1952	DD82037FFC85850A40B6C6561EF03ECB.exe
432	tPtOelFwqI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1676	schtasks.exe
1144	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1016	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1952	DD82037FFC85850A40B6C6561EF03ECB.exe
432	tPtOelFwqI.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 432	1952	DD82037FFC85850A40B6C6561EF03ECB.exe	31
PID 1952 wrote to memory of 432	1952	DD82037FFC85850A40B6C6561EF03ECB.exe	31
PID 1952 wrote to memory of 432	1952	DD82037FFC85850A40B6C6561EF03ECB.exe	31
PID 1952 wrote to memory of 432	1952	DD82037FFC85850A40B6C6561EF03ECB.exe	31
PID 1952 wrote to memory of 1360	1952	DD82037FFC85850A40B6C6561EF03ECB.exe	32
PID 1952 wrote to memory of 1360	1952	DD82037FFC85850A40B6C6561EF03ECB.exe	32
PID 1952 wrote to memory of 1360	1952	DD82037FFC85850A40B6C6561EF03ECB.exe	32
PID 1952 wrote to memory of 1360	1952	DD82037FFC85850A40B6C6561EF03ECB.exe	32
PID 1360 wrote to memory of 1016	1360	cmd.exe	34
PID 1360 wrote to memory of 1016	1360	cmd.exe	34
PID 1360 wrote to memory of 1016	1360	cmd.exe	34
PID 1360 wrote to memory of 1016	1360	cmd.exe	34
PID 432 wrote to memory of 1676	432	tPtOelFwqI.exe	35
PID 432 wrote to memory of 1676	432	tPtOelFwqI.exe	35
PID 432 wrote to memory of 1676	432	tPtOelFwqI.exe	35
PID 432 wrote to memory of 1676	432	tPtOelFwqI.exe	35
PID 1552 wrote to memory of 1748	1552	taskeng.exe	38
PID 1552 wrote to memory of 1748	1552	taskeng.exe	38
PID 1552 wrote to memory of 1748	1552	taskeng.exe	38
PID 1552 wrote to memory of 1748	1552	taskeng.exe	38

C:\Windows\system32\taskeng.exe
taskeng.exe {98A0BFEF-3B0D-435D-BC50-99E184086D6C} S-1-5-21-1669990088-476967504-438132596-1000:KJUCCLUP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"
    3⤵
    - Creates scheduled task(s)
    PID:1144