raccoon | e97f71d3020b3cf4c3d22ebe380a902fddc0e5ce666cc1b0059efe8e67860a72

General

Target
DD82037FFC85850A40B6C6561EF03ECB.exe
Size 5.2MB
Sample210906-11m7yabec2
SHA256 e97f71d3020b3cf4c3d22ebe380a902fddc0e5ce666cc1b0059efe8e67860a72
MD5 dd82037ffc85850a40b6c6561ef03ecb
SHA1 5e6078e228d3e53ffa6784609c0080bb9c48ae88
SHA512 dbb5029d2dafbec96ff39a2fa3eda85d2c58902e3fec0886b69f2b60a7571d360ac334aa76ce68638aa2d293883952b1b2afd07d1493e06e320f174a13564b18
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Attributes

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
1420	xOGXWa4Kqk.exe
4040	sihost.exe

Loads dropped DLL 1 IoCs

pid	Process
572	DD82037FFC85850A40B6C6561EF03ECB.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2096	schtasks.exe
892	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
628	timeout.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 572 wrote to memory of 1420	572	DD82037FFC85850A40B6C6561EF03ECB.exe	78
PID 572 wrote to memory of 1420	572	DD82037FFC85850A40B6C6561EF03ECB.exe	78
PID 572 wrote to memory of 1420	572	DD82037FFC85850A40B6C6561EF03ECB.exe	78
PID 572 wrote to memory of 3936	572	DD82037FFC85850A40B6C6561EF03ECB.exe	79
PID 572 wrote to memory of 3936	572	DD82037FFC85850A40B6C6561EF03ECB.exe	79
PID 572 wrote to memory of 3936	572	DD82037FFC85850A40B6C6561EF03ECB.exe	79
PID 3936 wrote to memory of 628	3936	cmd.exe	81
PID 3936 wrote to memory of 628	3936	cmd.exe	81
PID 3936 wrote to memory of 628	3936	cmd.exe	81
PID 1420 wrote to memory of 2096	1420	xOGXWa4Kqk.exe	82
PID 1420 wrote to memory of 2096	1420	xOGXWa4Kqk.exe	82
PID 1420 wrote to memory of 2096	1420	xOGXWa4Kqk.exe	82
PID 4040 wrote to memory of 892	4040	sihost.exe	85
PID 4040 wrote to memory of 892	4040	sihost.exe	85
PID 4040 wrote to memory of 892	4040	sihost.exe	85

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"
  2⤵
  - Creates scheduled task(s)
  PID:892