raccoon | f12e6cd63a8d0c79621de6f617a1d5d58a811bc5e9a5798aa7fdb2b6fc067971

General

Target
a1d15701e7d521d9a9ed1c4b37a86cc8.exe
Size 401KB
Sample220101-j7arragacj
SHA256 f12e6cd63a8d0c79621de6f617a1d5d58a811bc5e9a5798aa7fdb2b6fc067971
MD5 a1d15701e7d521d9a9ed1c4b37a86cc8
SHA1 d9fb261085a1e2eb370ec6770010d6a37c6f0269
SHA512 d8466d57bb336ad0dd0139aba1215d4b62c7cee5869b41c55dc24ba30c4da8e8caf78cae35653e007dc054cc5f83835ab94cfaf4618062ba0b20b4d59c315807
MD5 SHA1 SHA512

Score

10^/10

raccoon d6ee977d17e48189475aba8df49f69c7b76b5fa6 stealer

Malware Config

Extracted

Family

raccoon

Botnet

d6ee977d17e48189475aba8df49f69c7b76b5fa6

Attributes

url4cnc
http://185.163.204.21/charlyl12te

http://178.62.127.193/charlyl12te

http://5.181.156.155/charlyl12te

http://185.163.45.70/charlyl12te

http://185.163.204.22/charlyl12te

http://178.62.113.205/charlyl12te

https://t.me/charlyl12te

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1996	7876744305.exe

Loads dropped DLL 6 IoCs

pid	Process
336	cmd.exe
336	cmd.exe
1868	WerFault.exe
1868	WerFault.exe
1868	WerFault.exe
1868	WerFault.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1868	1996	WerFault.exe	31

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1868	WerFault.exe
1868	WerFault.exe
1868	WerFault.exe
1868	WerFault.exe
1868	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1868	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1868	WerFault.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 336	1516	a1d15701e7d521d9a9ed1c4b37a86cc8.exe	29
PID 1516 wrote to memory of 336	1516	a1d15701e7d521d9a9ed1c4b37a86cc8.exe	29
PID 1516 wrote to memory of 336	1516	a1d15701e7d521d9a9ed1c4b37a86cc8.exe	29
PID 1516 wrote to memory of 336	1516	a1d15701e7d521d9a9ed1c4b37a86cc8.exe	29
PID 336 wrote to memory of 1996	336	cmd.exe	31
PID 336 wrote to memory of 1996	336	cmd.exe	31
PID 336 wrote to memory of 1996	336	cmd.exe	31
PID 336 wrote to memory of 1996	336	cmd.exe	31
PID 1996 wrote to memory of 1868	1996	7876744305.exe	32
PID 1996 wrote to memory of 1868	1996	7876744305.exe	32
PID 1996 wrote to memory of 1868	1996	7876744305.exe	32
PID 1996 wrote to memory of 1868	1996	7876744305.exe	32

C:\Users\Admin\AppData\Local\Temp\a1d15701e7d521d9a9ed1c4b37a86cc8.exe
"C:\Users\Admin\AppData\Local\Temp\a1d15701e7d521d9a9ed1c4b37a86cc8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\7876744305.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:336
- - C:\Users\Admin\AppData\Local\Temp\7876744305.exe
    "C:\Users\Admin\AppData\Local\Temp\7876744305.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 476
      4⤵
      Loads dropped DLL
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:1868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

1

T1102

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1516-54-0x0000000000928000-0x0000000000948000-memory.dmp

Download

memory/1516-55-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Download

memory/1516-56-0x0000000000220000-0x0000000000258000-memory.dmp

Download

memory/1516-57-0x0000000000400000-0x0000000000791000-memory.dmp

Download

memory/1868-73-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/1996-66-0x0000000000840000-0x00000000008D2000-memory.dmp

Download

memory/1996-67-0x0000000000400000-0x00000000007C2000-memory.dmp

Download

memory/1996-64-0x0000000000308000-0x0000000000359000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads