raccoon | 70f0d443138e1ccb141a6bdbf7d6503a0505926bc01cff4fd45c8f9833ba9fd6

General

Target

338447d40e099471b745ab89c003011a8e3443fd687845a199b76ed67f462516.exe
Size

7.0MB
MD5

fdf89cef00011f087f541cf26851ffcf
SHA1

415c63fd0a62519ccdd761142baf052db0c9b148
SHA256

338447d40e099471b745ab89c003011a8e3443fd687845a199b76ed67f462516
SHA512

e01dd6913410bc78c234a9ff4a6c26d443335fdc0d8d12a528b8cb86559a2117d162f470181b63b20f857635aab4dd2538515dd3ba35172685c647aa1996f18a
SSDEEP

196608:vWoKh6/86G8izj595XAp9irEsXUX+EKAq:sQwN2LiHX2+EK

Score

10^/10

raccoon 1c145396a071df7e490bd2cf3def4bdf discovery persistence spyware stealer

Malware Config

Extracted

Family

raccoon

Botnet

1c145396a071df7e490bd2cf3def4bdf

C2

http://45.15.156.215/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

5859bnu4.exentlhost.exe

pid process

3592 5859bnu4.exe
2120 ntlhost.exe

pid	process
3592	5859bnu4.exe
2120	ntlhost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

338447d40e099471b745ab89c003011a8e3443fd687845a199b76ed67f462516.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	338447d40e099471b745ab89c003011a8e3443fd687845a199b76ed67f462516.exe

Loads dropped DLL 3 IoCs

Processes:

338447d40e099471b745ab89c003011a8e3443fd687845a199b76ed67f462516.exe

pid	process
4204	338447d40e099471b745ab89c003011a8e3443fd687845a199b76ed67f462516.exe
4204	338447d40e099471b745ab89c003011a8e3443fd687845a199b76ed67f462516.exe
4204	338447d40e099471b745ab89c003011a8e3443fd687845a199b76ed67f462516.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5859bnu4.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	5859bnu4.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

338447d40e099471b745ab89c003011a8e3443fd687845a199b76ed67f462516.exe

pid	process
4204	338447d40e099471b745ab89c003011a8e3443fd687845a199b76ed67f462516.exe
4204	338447d40e099471b745ab89c003011a8e3443fd687845a199b76ed67f462516.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 39 Go-http-client/1.1

description	flow	ioc
HTTP User-Agent header	39	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

338447d40e099471b745ab89c003011a8e3443fd687845a199b76ed67f462516.exe

pid	process
4204	338447d40e099471b745ab89c003011a8e3443fd687845a199b76ed67f462516.exe
4204	338447d40e099471b745ab89c003011a8e3443fd687845a199b76ed67f462516.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

338447d40e099471b745ab89c003011a8e3443fd687845a199b76ed67f462516.exe5859bnu4.exe

description	pid	process	target process
PID 4204 wrote to memory of 3592	4204	338447d40e099471b745ab89c003011a8e3443fd687845a199b76ed67f462516.exe	5859bnu4.exe
PID 4204 wrote to memory of 3592	4204	338447d40e099471b745ab89c003011a8e3443fd687845a199b76ed67f462516.exe	5859bnu4.exe
PID 3592 wrote to memory of 2120	3592	5859bnu4.exe	ntlhost.exe
PID 3592 wrote to memory of 2120	3592	5859bnu4.exe	ntlhost.exe

C:\Users\Admin\AppData\Local\Temp\338447d40e099471b745ab89c003011a8e3443fd687845a199b76ed67f462516.exe
"C:\Users\Admin\AppData\Local\Temp\338447d40e099471b745ab89c003011a8e3443fd687845a199b76ed67f462516.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4204

C:\Users\Admin\AppData\Local\Temp\5859bnu4.exe
"C:\Users\Admin\AppData\Local\Temp\5859bnu4.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3592

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
3⤵
- Executes dropped EXE
PID:2120

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\mozglue.dll
Filesize
612KB

MD5
f07d9977430e762b563eaadc2b94bbfa

SHA1
da0a05b2b8d269fb73558dfcf0ed5c167f6d3877

SHA256
4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862

SHA512
6afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf

Download Submit
C:\Users\Admin\AppData\LocalLow\nss3.dll
Filesize
1.9MB

MD5
f67d08e8c02574cbc2f1122c53bfb976

SHA1
6522992957e7e4d074947cad63189f308a80fcf2

SHA256
c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e

SHA512
2e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5

Download Submit
C:\Users\Admin\AppData\LocalLow\sqlite3.dll
Filesize
1.0MB

MD5
dbf4f8dcefb8056dc6bae4b67ff810ce

SHA1
bbac1dd8a07c6069415c04b62747d794736d0689

SHA256
47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68

SHA512
b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\5859bnu4.exe
Filesize
4.0MB

MD5
feccda803ece2e7a3b7e9798714ad47e

SHA1
e97182adccf8a7692e6ad2614b0fb7fd3898a1a2

SHA256
14529dca41abfea65abb51c84ec34ba0a951581586f98cef60213ae949a78320

SHA512
dec5fd4d184772ca590333b2382706c6e5a7b5050f9ae98af813192e06500424870e8332a1406c763e5cc6d266ddd7e09280b6bf118392fa6edea6fab5843287

Download Submit
C:\Users\Admin\AppData\Local\Temp\5859bnu4.exe
Filesize
4.0MB

MD5
feccda803ece2e7a3b7e9798714ad47e

SHA1
e97182adccf8a7692e6ad2614b0fb7fd3898a1a2

SHA256
14529dca41abfea65abb51c84ec34ba0a951581586f98cef60213ae949a78320

SHA512
dec5fd4d184772ca590333b2382706c6e5a7b5050f9ae98af813192e06500424870e8332a1406c763e5cc6d266ddd7e09280b6bf118392fa6edea6fab5843287

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Filesize
685.5MB

MD5
9e0fbb3718c7f0fdd50140ab819b83b1

SHA1
8dc3d286a8030f9da30a593354e8177f0dd73083

SHA256
7c193475add483188f0514bdd69254f5974a422ff1dbf326c2c30da23175d357

SHA512
46a17d5c9de4366fb453a050da790f4ebeef48a966c05444afd72e157564322747cbd377622ac49069ac3c7f9237b25c15d1cc24995f73e5b6d9d704f042a749

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Filesize
690.2MB

MD5
4cd0b394e343ff0711dc380928b4b47f

SHA1
78b4695b49a7b047002bbf65c141f5f80badf2d7

SHA256
8a5b5276d5b2c44f6407a0741f6f35177a63759589edd5216a7c10326ad3d0f0

SHA512
72821bba4a9c713405d8a7193f4d3fff392e2e253400e9bbfcf717da6f8091d874c17144a01a782b3f5dc2893c97733c781f21ae04beae3f2340ccbbf9869f9c

Download Submit
memory/2120-144-0x0000000000000000-mapping.dmp

Download
memory/3592-140-0x0000000000000000-mapping.dmp

Download
memory/4204-135-0x0000000000400000-0x0000000000EA4000-memory.dmp

Filesize
10.6MB

Download
memory/4204-139-0x0000000000400000-0x0000000000EA4000-memory.dmp

Filesize
10.6MB

Download
memory/4204-134-0x0000000000400000-0x0000000000EA4000-memory.dmp

Filesize
10.6MB

Download
memory/4204-132-0x0000000000400000-0x0000000000EA4000-memory.dmp

Filesize
10.6MB

Download
memory/4204-143-0x0000000000400000-0x0000000000EA4000-memory.dmp

Filesize
10.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads