raccoon | ddc293e024821f0870ae59a138e5b9b78047fa2d109e954e18bdfdd6c3ac4c41

General

Target
58bc6d515945a308bfc35358455c96ed.exe
Size 402KB
Sample210925-lrnd1sahdn
SHA256 ddc293e024821f0870ae59a138e5b9b78047fa2d109e954e18bdfdd6c3ac4c41
MD5 58bc6d515945a308bfc35358455c96ed
SHA1 b2486bf163f7c3ee1c577106418ec90b0af58c16
SHA512 0c06cf503afd66797dbdb25bbe83f20c114a6ea10bfbcaa8888b92113f202476405b8e4e5b482f8119ee5990a5933cf1f3e0a236a2220899a872a76ad178b9f7
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Attributes

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
suricata
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
3692	9Y4jlbV9zK.exe
912	sihost.exe

Loads dropped DLL 6 IoCs

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3368	schtasks.exe
692	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2340	timeout.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 3692	2060	58bc6d515945a308bfc35358455c96ed.exe	70
PID 2060 wrote to memory of 3692	2060	58bc6d515945a308bfc35358455c96ed.exe	70
PID 2060 wrote to memory of 3692	2060	58bc6d515945a308bfc35358455c96ed.exe	70
PID 2060 wrote to memory of 3392	2060	58bc6d515945a308bfc35358455c96ed.exe	71
PID 2060 wrote to memory of 3392	2060	58bc6d515945a308bfc35358455c96ed.exe	71
PID 2060 wrote to memory of 3392	2060	58bc6d515945a308bfc35358455c96ed.exe	71
PID 3392 wrote to memory of 2340	3392	cmd.exe	73
PID 3392 wrote to memory of 2340	3392	cmd.exe	73
PID 3392 wrote to memory of 2340	3392	cmd.exe	73
PID 3692 wrote to memory of 3368	3692	9Y4jlbV9zK.exe	74
PID 3692 wrote to memory of 3368	3692	9Y4jlbV9zK.exe	74
PID 3692 wrote to memory of 3368	3692	9Y4jlbV9zK.exe	74
PID 912 wrote to memory of 692	912	sihost.exe	77
PID 912 wrote to memory of 692	912	sihost.exe	77
PID 912 wrote to memory of 692	912	sihost.exe	77

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"
  2⤵
  - Creates scheduled task(s)
  PID:692