raccoon | 1a14097ff774fe463491a6c444a4bf3f7419433ebfc86b511757f2f336e44b3b

General

Target

1a14097ff774fe463491a6c444a4bf3f7419433ebfc86b511757f2f336e44b3b.exe
Size

1.2MB
MD5

840a9628f0b877320c144b9968a036be
SHA1

ccbd1a391b1960eb818043e6d2e0b67601180dee
SHA256

1a14097ff774fe463491a6c444a4bf3f7419433ebfc86b511757f2f336e44b3b
SHA512

a62b5d6024b57f1b021b2e2873e56b1bf35d682110cc8ff04c2be944c0926084e13f4de6ab6f4f99a30d13f6c4cb2a433960df123159b2aae3782e074dbca27d

Score

10^/10

raccoon 65d90e36e3587fb188a3d819652094e85ff22e28 persistence stealer

Malware Config

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

65d90e36e3587fb188a3d819652094e85ff22e28

Attributes

url4cnc
http://178.23.190.57/redhe1r2

http://91.219.236.162/redhe1r2

http://185.163.47.176/redhe1r2

http://193.38.54.238/redhe1r2

http://74.119.192.122/redhe1r2

http://91.219.236.240/redhe1r2

https://t.me/redhe1r2

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1332 created 1304	1332	WerFault.exe	78

Executes dropped EXE 2 IoCs

pid	Process
2212	Puo.exe.com
4028	Puo.exe.com

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	1a14097ff774fe463491a6c444a4bf3f7419433ebfc86b511757f2f336e44b3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1a14097ff774fe463491a6c444a4bf3f7419433ebfc86b511757f2f336e44b3b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4028 set thread context of 1304	4028	Puo.exe.com	78

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1332	1304	WerFault.exe	78

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
916	PING.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1332	WerFault.exe
1332	WerFault.exe
1332	WerFault.exe
1332	WerFault.exe
1332	WerFault.exe
1332	WerFault.exe
1332	WerFault.exe
1332	WerFault.exe
1332	WerFault.exe
1332	WerFault.exe
1332	WerFault.exe
1332	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	1332	WerFault.exe
Token: SeBackupPrivilege	1332	WerFault.exe
Token: SeDebugPrivilege	1332	WerFault.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2212	Puo.exe.com
2212	Puo.exe.com
2212	Puo.exe.com
4028	Puo.exe.com
4028	Puo.exe.com
4028	Puo.exe.com

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
2212	Puo.exe.com
2212	Puo.exe.com
2212	Puo.exe.com
4028	Puo.exe.com
4028	Puo.exe.com
4028	Puo.exe.com

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 2320	4024	1a14097ff774fe463491a6c444a4bf3f7419433ebfc86b511757f2f336e44b3b.exe	69
PID 4024 wrote to memory of 2320	4024	1a14097ff774fe463491a6c444a4bf3f7419433ebfc86b511757f2f336e44b3b.exe	69
PID 4024 wrote to memory of 2320	4024	1a14097ff774fe463491a6c444a4bf3f7419433ebfc86b511757f2f336e44b3b.exe	69
PID 4024 wrote to memory of 644	4024	1a14097ff774fe463491a6c444a4bf3f7419433ebfc86b511757f2f336e44b3b.exe	71
PID 4024 wrote to memory of 644	4024	1a14097ff774fe463491a6c444a4bf3f7419433ebfc86b511757f2f336e44b3b.exe	71
PID 4024 wrote to memory of 644	4024	1a14097ff774fe463491a6c444a4bf3f7419433ebfc86b511757f2f336e44b3b.exe	71
PID 644 wrote to memory of 1388	644	cmd.exe	73
PID 644 wrote to memory of 1388	644	cmd.exe	73
PID 644 wrote to memory of 1388	644	cmd.exe	73
PID 1388 wrote to memory of 952	1388	cmd.exe	74
PID 1388 wrote to memory of 952	1388	cmd.exe	74
PID 1388 wrote to memory of 952	1388	cmd.exe	74
PID 1388 wrote to memory of 2212	1388	cmd.exe	75
PID 1388 wrote to memory of 2212	1388	cmd.exe	75
PID 1388 wrote to memory of 2212	1388	cmd.exe	75
PID 1388 wrote to memory of 916	1388	cmd.exe	76
PID 1388 wrote to memory of 916	1388	cmd.exe	76
PID 1388 wrote to memory of 916	1388	cmd.exe	76
PID 2212 wrote to memory of 4028	2212	Puo.exe.com	77
PID 2212 wrote to memory of 4028	2212	Puo.exe.com	77
PID 2212 wrote to memory of 4028	2212	Puo.exe.com	77
PID 4028 wrote to memory of 1304	4028	Puo.exe.com	78
PID 4028 wrote to memory of 1304	4028	Puo.exe.com	78
PID 4028 wrote to memory of 1304	4028	Puo.exe.com	78
PID 4028 wrote to memory of 1304	4028	Puo.exe.com	78
PID 4028 wrote to memory of 1304	4028	Puo.exe.com	78

C:\Users\Admin\AppData\Local\Temp\1a14097ff774fe463491a6c444a4bf3f7419433ebfc86b511757f2f336e44b3b.exe
"C:\Users\Admin\AppData\Local\Temp\1a14097ff774fe463491a6c444a4bf3f7419433ebfc86b511757f2f336e44b3b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\SysWOW64\makecab.exe
  makecab
  2⤵
  PID:2320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Scegliendo.pps
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:644
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1388
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^HqqpGiftuqDiPimRPgWJVfnlGPtccJKuuAnCyDsUZiklFrajRramWifsCPDQeUJvfbqgJWLjWwKOrhFCbSEsslpZluqfZBS$" Confusione.pps
      4⤵
      PID:952
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Puo.exe.com
      Puo.exe.com C
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Puo.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Puo.exe.com C
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4028
      - C:\Windows\SysWOW64\nslookup.exe
        
        C:\Windows\SysWOW64\nslookup.exe
        6⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 168
        7⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1332
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1
      4⤵
      Runs ping.exe
      PID:916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1304-132-0x0000000000A00000-0x0000000000A91000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing