raccoon | 9a1d08d8158e5278734fc0a434e73ca6279e7586b0c1dfc3f7d71c6c76a9de0d

General

Target
436a9d01e4384a9be90339fa4c0c92ec.exe
Size 402KB
Sample210925-2stv7aeac6
SHA256 9a1d08d8158e5278734fc0a434e73ca6279e7586b0c1dfc3f7d71c6c76a9de0d
MD5 436a9d01e4384a9be90339fa4c0c92ec
SHA1 19421cca9409d625931049eaa7d509eb7f677115
SHA512 8f3024eed16c2d0937520ab800418294e33e57f6a2bed74e88535e71637e5393f342c8da9a1ba87dd315984cd1b15b18fdde81916cc9bbf07c78c42c865c4e1e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Attributes

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
500	RpkS3wPwNs.exe
2720	sihost.exe

Loads dropped DLL 6 IoCs

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2976	schtasks.exe
3972	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3164	timeout.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 500	532	436a9d01e4384a9be90339fa4c0c92ec.exe	68
PID 532 wrote to memory of 500	532	436a9d01e4384a9be90339fa4c0c92ec.exe	68
PID 532 wrote to memory of 500	532	436a9d01e4384a9be90339fa4c0c92ec.exe	68
PID 532 wrote to memory of 3128	532	436a9d01e4384a9be90339fa4c0c92ec.exe	69
PID 532 wrote to memory of 3128	532	436a9d01e4384a9be90339fa4c0c92ec.exe	69
PID 532 wrote to memory of 3128	532	436a9d01e4384a9be90339fa4c0c92ec.exe	69
PID 3128 wrote to memory of 3164	3128	cmd.exe	71
PID 3128 wrote to memory of 3164	3128	cmd.exe	71
PID 3128 wrote to memory of 3164	3128	cmd.exe	71
PID 500 wrote to memory of 2976	500	RpkS3wPwNs.exe	72
PID 500 wrote to memory of 2976	500	RpkS3wPwNs.exe	72
PID 500 wrote to memory of 2976	500	RpkS3wPwNs.exe	72
PID 2720 wrote to memory of 3972	2720	sihost.exe	81
PID 2720 wrote to memory of 3972	2720	sihost.exe	81
PID 2720 wrote to memory of 3972	2720	sihost.exe	81

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"
  2⤵
  - Creates scheduled task(s)
  PID:3972