Overview

overview

10

Static

static

0cbb101350...87.exe

windows7-x64

10

0cbb101350...87.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0cbb101350a505349559995cac335687.exe

  • Size

    22.8MB

  • Sample

    220920-sgrf9ahagk

  • MD5

    0cbb101350a505349559995cac335687

  • SHA1

    49fa668a551e694d3dc85b0dedadf6da2f7a79b7

  • SHA256

    bc92ac427770e9d3e2e12ed5f25d1a8d92c43f6342b675f6e1d2ec70b86601fe

  • SHA512

    36fe16fd2c18a056afa743879822cd845ff5498061f27e123530f665fbf1fadf1576a5c02c5c0e0f1af88cc2c40eaad618716c30b1c8d8812aa903938698586a

  • SSDEEP

    393216:ne+m1n15+inMR/oArvMwVuwxTakRcLGZNXDqkV2R0h6g1Rkymg1:9InH7nMR/oExVrxe1L6JV2eh6g1Ky51

Score
10/10
raccoon9b19cf60d9bdf65b8a2495aa965456c3evasionspywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://45.159.248.145/hfile.bin

Extracted

Family

raccoon

Botnet

9b19cf60d9bdf65b8a2495aa965456c3

C2

http://94.131.107.23/

http://45.11.19.99/
rc4.plain

Targets

    • Target

      0cbb101350a505349559995cac335687.exe

    • Size

      22.8MB

    • MD5

      0cbb101350a505349559995cac335687

    • SHA1

      49fa668a551e694d3dc85b0dedadf6da2f7a79b7

    • SHA256

      bc92ac427770e9d3e2e12ed5f25d1a8d92c43f6342b675f6e1d2ec70b86601fe

    • SHA512

      36fe16fd2c18a056afa743879822cd845ff5498061f27e123530f665fbf1fadf1576a5c02c5c0e0f1af88cc2c40eaad618716c30b1c8d8812aa903938698586a

    • SSDEEP

      393216:ne+m1n15+inMR/oArvMwVuwxTakRcLGZNXDqkV2R0h6g1Rkymg1:9InH7nMR/oExVrxe1L6JV2eh6g1Ky51

    Score
    10/10
    raccoon9b19cf60d9bdf65b8a2495aa965456c3evasionspywarestealertrojan

    • Modifies Windows Defender notification settings

      evasiontrojan

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Disabling Security Tools

1
T1089

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks