raccoon | 1a14097ff774fe463491a6c444a4bf3f7419433ebfc86b511757f2f336e44b3b

General

Target

840a9628f0b877320c144b9968a036be.exe
Size

1.2MB
MD5

840a9628f0b877320c144b9968a036be
SHA1

ccbd1a391b1960eb818043e6d2e0b67601180dee
SHA256

1a14097ff774fe463491a6c444a4bf3f7419433ebfc86b511757f2f336e44b3b
SHA512

a62b5d6024b57f1b021b2e2873e56b1bf35d682110cc8ff04c2be944c0926084e13f4de6ab6f4f99a30d13f6c4cb2a433960df123159b2aae3782e074dbca27d

Score

10^/10

raccoon 65d90e36e3587fb188a3d819652094e85ff22e28 persistence stealer

Malware Config

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

65d90e36e3587fb188a3d819652094e85ff22e28

Attributes

url4cnc
http://178.23.190.57/redhe1r2

http://91.219.236.162/redhe1r2

http://185.163.47.176/redhe1r2

http://193.38.54.238/redhe1r2

http://74.119.192.122/redhe1r2

http://91.219.236.240/redhe1r2

https://t.me/redhe1r2

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2560 created 1532	2560	WerFault.exe	80

Executes dropped EXE 2 IoCs

pid	Process
4556	Puo.exe.com
3304	Puo.exe.com

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	840a9628f0b877320c144b9968a036be.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	840a9628f0b877320c144b9968a036be.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3304 set thread context of 1532	3304	Puo.exe.com	80

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2560	1532	WerFault.exe	80

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4484	PING.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2560	WerFault.exe
Token: SeBackupPrivilege	2560	WerFault.exe
Token: SeDebugPrivilege	2560	WerFault.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4556	Puo.exe.com
4556	Puo.exe.com
4556	Puo.exe.com
3304	Puo.exe.com
3304	Puo.exe.com
3304	Puo.exe.com

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
4556	Puo.exe.com
4556	Puo.exe.com
4556	Puo.exe.com
3304	Puo.exe.com
3304	Puo.exe.com
3304	Puo.exe.com

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 3240	4300	840a9628f0b877320c144b9968a036be.exe	68
PID 4300 wrote to memory of 3240	4300	840a9628f0b877320c144b9968a036be.exe	68
PID 4300 wrote to memory of 3240	4300	840a9628f0b877320c144b9968a036be.exe	68
PID 4300 wrote to memory of 4352	4300	840a9628f0b877320c144b9968a036be.exe	70
PID 4300 wrote to memory of 4352	4300	840a9628f0b877320c144b9968a036be.exe	70
PID 4300 wrote to memory of 4352	4300	840a9628f0b877320c144b9968a036be.exe	70
PID 4352 wrote to memory of 1876	4352	cmd.exe	72
PID 4352 wrote to memory of 1876	4352	cmd.exe	72
PID 4352 wrote to memory of 1876	4352	cmd.exe	72
PID 1876 wrote to memory of 2212	1876	cmd.exe	73
PID 1876 wrote to memory of 2212	1876	cmd.exe	73
PID 1876 wrote to memory of 2212	1876	cmd.exe	73
PID 1876 wrote to memory of 4556	1876	cmd.exe	74
PID 1876 wrote to memory of 4556	1876	cmd.exe	74
PID 1876 wrote to memory of 4556	1876	cmd.exe	74
PID 1876 wrote to memory of 4484	1876	cmd.exe	75
PID 1876 wrote to memory of 4484	1876	cmd.exe	75
PID 1876 wrote to memory of 4484	1876	cmd.exe	75
PID 4556 wrote to memory of 3304	4556	Puo.exe.com	76
PID 4556 wrote to memory of 3304	4556	Puo.exe.com	76
PID 4556 wrote to memory of 3304	4556	Puo.exe.com	76
PID 3304 wrote to memory of 1532	3304	Puo.exe.com	80
PID 3304 wrote to memory of 1532	3304	Puo.exe.com	80
PID 3304 wrote to memory of 1532	3304	Puo.exe.com	80
PID 3304 wrote to memory of 1532	3304	Puo.exe.com	80
PID 3304 wrote to memory of 1532	3304	Puo.exe.com	80

C:\Users\Admin\AppData\Local\Temp\840a9628f0b877320c144b9968a036be.exe
"C:\Users\Admin\AppData\Local\Temp\840a9628f0b877320c144b9968a036be.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\SysWOW64\makecab.exe
  makecab
  2⤵
  PID:3240
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Scegliendo.pps
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1876
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^HqqpGiftuqDiPimRPgWJVfnlGPtccJKuuAnCyDsUZiklFrajRramWifsCPDQeUJvfbqgJWLjWwKOrhFCbSEsslpZluqfZBS$" Confusione.pps
      4⤵
      PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Puo.exe.com
      Puo.exe.com C
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Puo.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Puo.exe.com C
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3304
      - C:\Windows\SysWOW64\nslookup.exe
        
        C:\Windows\SysWOW64\nslookup.exe
        6⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 172
        7⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2560
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1532-129-0x0000000000670000-0x0000000000701000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing