raccoon | 0eea18e379f7584683a4f20cff23626959723d4f0f44843e3e6bddad4a6ed979

General

Target

0eea18e379f7584683a4f20cff23626959723d4f0f44843e3e6bddad4a6ed979.exe
Size

2.9MB
MD5

da1148b8f114375feffde85b5cf2ff77
SHA1

adb56de256b2d4ffb0e8f29b149f8a835c758c03
SHA256

0eea18e379f7584683a4f20cff23626959723d4f0f44843e3e6bddad4a6ed979
SHA512

713fa3825ea8c6943e2ba375eb14c03f307d27f7ffb2ce14a6db2a6be1485193840f7294f337ce33e612c9a9c0120a8c02e70833183f632bcbc717943d4f309f
SSDEEP

24576:HnvReesL/CfIkqpGN9WmF088Ukc8k0cc0E8ck088Ukc8k0eo8IkocI0IcokI8oUy:HvRe5xAWivs8fDKmW

Score

10^/10

raccoon bd3a3a503834ef8e836d8a99d1ecff54 spyware stealer

Malware Config

Extracted

Family

raccoon

Botnet

bd3a3a503834ef8e836d8a99d1ecff54

C2

http://135.148.104.11/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Downloads MZ/PE file

Loads dropped DLL 4 IoCs

pid	Process
2016	0eea18e379f7584683a4f20cff23626959723d4f0f44843e3e6bddad4a6ed979.exe
1700	CasPol.exe
1700	CasPol.exe
1700	CasPol.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2016 set thread context of 1700	2016	0eea18e379f7584683a4f20cff23626959723d4f0f44843e3e6bddad4a6ed979.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2016	0eea18e379f7584683a4f20cff23626959723d4f0f44843e3e6bddad4a6ed979.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1700	2016	0eea18e379f7584683a4f20cff23626959723d4f0f44843e3e6bddad4a6ed979.exe	26
PID 2016 wrote to memory of 1700	2016	0eea18e379f7584683a4f20cff23626959723d4f0f44843e3e6bddad4a6ed979.exe	26
PID 2016 wrote to memory of 1700	2016	0eea18e379f7584683a4f20cff23626959723d4f0f44843e3e6bddad4a6ed979.exe	26
PID 2016 wrote to memory of 1700	2016	0eea18e379f7584683a4f20cff23626959723d4f0f44843e3e6bddad4a6ed979.exe	26
PID 2016 wrote to memory of 1700	2016	0eea18e379f7584683a4f20cff23626959723d4f0f44843e3e6bddad4a6ed979.exe	26
PID 2016 wrote to memory of 1700	2016	0eea18e379f7584683a4f20cff23626959723d4f0f44843e3e6bddad4a6ed979.exe	26
PID 2016 wrote to memory of 1700	2016	0eea18e379f7584683a4f20cff23626959723d4f0f44843e3e6bddad4a6ed979.exe	26
PID 2016 wrote to memory of 1700	2016	0eea18e379f7584683a4f20cff23626959723d4f0f44843e3e6bddad4a6ed979.exe	26
PID 2016 wrote to memory of 1700	2016	0eea18e379f7584683a4f20cff23626959723d4f0f44843e3e6bddad4a6ed979.exe	26
PID 2016 wrote to memory of 1700	2016	0eea18e379f7584683a4f20cff23626959723d4f0f44843e3e6bddad4a6ed979.exe	26

C:\Users\Admin\AppData\Local\Temp\0eea18e379f7584683a4f20cff23626959723d4f0f44843e3e6bddad4a6ed979.exe
"C:\Users\Admin\AppData\Local\Temp\0eea18e379f7584683a4f20cff23626959723d4f0f44843e3e6bddad4a6ed979.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  - Loads dropped DLL
  PID:1700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\LocalLow\mozglue.dll

Filesize
612KB

MD5
f07d9977430e762b563eaadc2b94bbfa

SHA1
da0a05b2b8d269fb73558dfcf0ed5c167f6d3877

SHA256
4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862

SHA512
6afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf

Download Submit
\Users\Admin\AppData\LocalLow\nss3.dll

Filesize
1.9MB

MD5
f67d08e8c02574cbc2f1122c53bfb976

SHA1
6522992957e7e4d074947cad63189f308a80fcf2

SHA256
c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e

SHA512
2e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5

Download Submit
\Users\Admin\AppData\LocalLow\sqlite3.dll

Filesize
1.0MB

MD5
dbf4f8dcefb8056dc6bae4b67ff810ce

SHA1
bbac1dd8a07c6069415c04b62747d794736d0689

SHA256
47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68

SHA512
b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1

Download Submit
\Users\Admin\AppData\Local\Temp\c595f62c-079d-4218-a25a-57319781bbef\chromebypass.dll

Filesize
141KB

MD5
e8641f344213ca05d8b5264b5f4e2dee

SHA1
96729e31f9b805800b2248fd22a4b53e226c8309

SHA256
85e82b9e9200e798e8f434459eacee03ed9818cc6c9a513fe083e72d48884e24

SHA512
3130f32c100ecb97083ad8ac4c67863e9ceed3a9b06fc464d1aeeaec389f74c8bf56f4ce04f6450fd2cc0fa861d085101c433cfa4bec3095f8ebeeb53b739109

Download Submit
memory/1700-67-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1700-60-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1700-62-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1700-64-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1700-65-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1700-77-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1700-59-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1700-73-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1700-70-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1700-72-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/2016-71-0x000007FEFB7B0000-0x000007FEFB7D8000-memory.dmp

Filesize
160KB

Download
memory/2016-58-0x0000000000590000-0x000000000059A000-memory.dmp

Filesize
40KB

Download
memory/2016-57-0x000007FEFB7B0000-0x000007FEFB7D8000-memory.dmp

Filesize
160KB

Download
memory/2016-56-0x000007FEF70A0000-0x000007FEF71CC000-memory.dmp

Filesize
1.2MB

Download
memory/2016-54-0x00000000008D0000-0x0000000000BB2000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing