raccoon | 3e929304dd13990cc2fdb0673a8eac7387fac96052f76f9fd432c3fc7f04fd1d

General

Target
82729b46754db1f3eb73be457bdcc42c.exe
Size 434KB
Sample210925-wcbf1sdfh2
SHA256 3e929304dd13990cc2fdb0673a8eac7387fac96052f76f9fd432c3fc7f04fd1d
MD5 82729b46754db1f3eb73be457bdcc42c
SHA1 05c82572c7b189ae065f8c3d24f73c17ada3a801
SHA512 c73b678a77caf6ab4ba88d9933f35b98479fa56e858a2a6bb61e17f6394d042543d47acaef91de75878205cca22fb05be86011bab34aa96eb82f5d07825ac958
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Attributes

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
60	zzYemT1YAL.exe
2220	sihost.exe

Loads dropped DLL 6 IoCs

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
816	schtasks.exe
2388	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
644	timeout.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 60	4016	82729b46754db1f3eb73be457bdcc42c.exe	68
PID 4016 wrote to memory of 60	4016	82729b46754db1f3eb73be457bdcc42c.exe	68
PID 4016 wrote to memory of 60	4016	82729b46754db1f3eb73be457bdcc42c.exe	68
PID 4016 wrote to memory of 64	4016	82729b46754db1f3eb73be457bdcc42c.exe	69
PID 4016 wrote to memory of 64	4016	82729b46754db1f3eb73be457bdcc42c.exe	69
PID 4016 wrote to memory of 64	4016	82729b46754db1f3eb73be457bdcc42c.exe	69
PID 64 wrote to memory of 644	64	cmd.exe	71
PID 64 wrote to memory of 644	64	cmd.exe	71
PID 64 wrote to memory of 644	64	cmd.exe	71
PID 60 wrote to memory of 816	60	zzYemT1YAL.exe	72
PID 60 wrote to memory of 816	60	zzYemT1YAL.exe	72
PID 60 wrote to memory of 816	60	zzYemT1YAL.exe	72
PID 2220 wrote to memory of 2388	2220	sihost.exe	77
PID 2220 wrote to memory of 2388	2220	sihost.exe	77
PID 2220 wrote to memory of 2388	2220	sihost.exe	77

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"
  2⤵
  - Creates scheduled task(s)
  PID:2388