raccoon | 9998a13c9765059b9bb6dc9795b5af7d83a575b1994bd455a9cfc890a8f8f055

Analysis

max time kernel
205s
max time network
208s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
25-06-2023 08:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ISL Light.exe
Size

591KB
MD5

0c7b1b300029227ec246a0c51034bcba
SHA1

e3d02142d073267b9e723fe20b8f8cf1ca1446bb
SHA256

9998a13c9765059b9bb6dc9795b5af7d83a575b1994bd455a9cfc890a8f8f055
SHA512

bbb81c66f39789eb64dd67f52c3c5cb40ce50c4e89bda40fbc5751ff4e796779c16b8257a15e930ee318b8b36d1995a89f05149475a43da346849c18f6e3ca70
SSDEEP

12288:j9m4MBiB/6tV1C8tCeRuaqRK2opT7sQ2qN+VN6BUzNt6Oa4n5I:j9m4PBStV/CeHqRKj7R2K+OGt6In+

Score

10^/10

raccoon stealer

Malware Config

Extracted

Family

raccoon

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Executes dropped EXE 2 IoCs

Processes:

ISLLight_4_4_2234_59.exeISLLight.exe

pid process

988 ISLLight_4_4_2234_59.exe
1000 ISLLight.exe

pid	process
988	ISLLight_4_4_2234_59.exe
1000	ISLLight.exe

Loads dropped DLL 6 IoCs

Processes:

ISL Light.exeISLLight_4_4_2234_59.exe

pid	process
1304	ISL Light.exe
1304	ISL Light.exe
988	ISLLight_4_4_2234_59.exe
988	ISLLight_4_4_2234_59.exe
988	ISLLight_4_4_2234_59.exe
988	ISLLight_4_4_2234_59.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

ISLLight.exe

pid process

1000 ISLLight.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ISLLight.exe

pid process

1000 ISLLight.exe

pid	process
1000	ISLLight.exe

pid	process
1000	ISLLight.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ISL Light.exeISLLight_4_4_2234_59.exe

description	pid	process	target process
PID 1304 wrote to memory of 988	1304	ISL Light.exe	ISLLight_4_4_2234_59.exe
PID 1304 wrote to memory of 988	1304	ISL Light.exe	ISLLight_4_4_2234_59.exe
PID 1304 wrote to memory of 988	1304	ISL Light.exe	ISLLight_4_4_2234_59.exe
PID 1304 wrote to memory of 988	1304	ISL Light.exe	ISLLight_4_4_2234_59.exe
PID 988 wrote to memory of 1000	988	ISLLight_4_4_2234_59.exe	ISLLight.exe
PID 988 wrote to memory of 1000	988	ISLLight_4_4_2234_59.exe	ISLLight.exe
PID 988 wrote to memory of 1000	988	ISLLight_4_4_2234_59.exe	ISLLight.exe
PID 988 wrote to memory of 1000	988	ISLLight_4_4_2234_59.exe	ISLLight.exe

C:\Users\Admin\AppData\Local\Temp\ISL Light.exe
"C:\Users\Admin\AppData\Local\Temp\ISL Light.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\extract_1687681228_1304_924_1862629937\ISLLight_4_4_2234_59.exe
  ISLLight_4_4_2234_59.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Light\1\ISLLight.exe
    "C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Light\1\ISLLight.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:1000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Light\1\ISLLight.exe

Filesize
22.8MB

MD5
b654b60c47e5d034a074552220f04054

SHA1
5ef13e9c3b9faf5e8f1fd63a227fc2da6d7c6b98

SHA256
01c1bc88cf97d11d15257fb4b27486552898569dc73fdaa6e56b799d28febaa3

SHA512
1903a9d3ab07dfd1aa1f700a26fe6dae8a12559b0acf3dc30f697499167cf35ca1586c6d2504f38343be18bdd8ecd861bcd76f29ab4dd9645505a032cc3352ca

Download Submit
C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\extract_1687681228_1304_924_1862629937\ISLLight_4_4_2234_59.exe

Filesize
13.6MB

MD5
31586ee036dbae8ce3da4656112111dd

SHA1
69759e43c56bb70d0d9bbb955429ce5043da74f8

SHA256
9ab2900cc6f23d8445c3004f03891fa4c620bd9a25f628f09485d669c173060f

SHA512
d03ba011d0ed6ed7e0706402b64517d37e274064f2fcc32afe3d418408451c428f3cbe31010fbad2af2784fdc06b1beabe85b175cc1f12e640514913b3a8d41d

Download Submit
C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\extract_1687681228_1304_924_1862629937\ISLLight_4_4_2234_59.exe

Filesize
13.6MB

MD5
31586ee036dbae8ce3da4656112111dd

SHA1
69759e43c56bb70d0d9bbb955429ce5043da74f8

SHA256
9ab2900cc6f23d8445c3004f03891fa4c620bd9a25f628f09485d669c173060f

SHA512
d03ba011d0ed6ed7e0706402b64517d37e274064f2fcc32afe3d418408451c428f3cbe31010fbad2af2784fdc06b1beabe85b175cc1f12e640514913b3a8d41d

Download Submit
C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\isl_network_start.log

Filesize
21KB

MD5
b7fb6679e2fb33f68011b5647f9a44d7

SHA1
58b8745ba6c0d06c12deefc4a83a4c51addace30

SHA256
d700045f246479df56107e11bfe534c773d2046e6e215cf65cea6ddaafd63216

SHA512
ec7b036aaf127daa36e1571a19000646d910ea52d01ad3c64305b6a3a078730c5c4352e5eff5650afcd72d164848c2766720aac104739f651babc5ab360d98c7

Download Submit
C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\isl_network_start.log

Filesize
4KB

MD5
991a7a23015b0f32ad979bf4a9fde533

SHA1
a70ebbb2b93bec4d1f5d742b5fa29d902efaa428

SHA256
bbf7880ddad3e32f5f617f0085b4a4d6a973d6a1832df0988c7351c7cd68e169

SHA512
903efe86879ef6a75d9f8cdd44b83cf17d785c1513e41849f6fd2e35c55f1af73645d721fccb1fd22c906f11f7cfcc3cbe8d661b1936379e120a85f49b2895b1

Download Submit
\Users\Admin\AppData\Local\ISL Online Cache\ISL Light\1\ISLLight.exe

Filesize
22.8MB

MD5
b654b60c47e5d034a074552220f04054

SHA1
5ef13e9c3b9faf5e8f1fd63a227fc2da6d7c6b98

SHA256
01c1bc88cf97d11d15257fb4b27486552898569dc73fdaa6e56b799d28febaa3

SHA512
1903a9d3ab07dfd1aa1f700a26fe6dae8a12559b0acf3dc30f697499167cf35ca1586c6d2504f38343be18bdd8ecd861bcd76f29ab4dd9645505a032cc3352ca

Download Submit
\Users\Admin\AppData\Local\ISL Online Cache\ISL Light\1\ISLLight.exe

Filesize
22.8MB

MD5
b654b60c47e5d034a074552220f04054

SHA1
5ef13e9c3b9faf5e8f1fd63a227fc2da6d7c6b98

SHA256
01c1bc88cf97d11d15257fb4b27486552898569dc73fdaa6e56b799d28febaa3

SHA512
1903a9d3ab07dfd1aa1f700a26fe6dae8a12559b0acf3dc30f697499167cf35ca1586c6d2504f38343be18bdd8ecd861bcd76f29ab4dd9645505a032cc3352ca

Download Submit
\Users\Admin\AppData\Local\ISL Online Cache\ISL Light\1\ISLLight.exe

Filesize
22.8MB

MD5
b654b60c47e5d034a074552220f04054

SHA1
5ef13e9c3b9faf5e8f1fd63a227fc2da6d7c6b98

SHA256
01c1bc88cf97d11d15257fb4b27486552898569dc73fdaa6e56b799d28febaa3

SHA512
1903a9d3ab07dfd1aa1f700a26fe6dae8a12559b0acf3dc30f697499167cf35ca1586c6d2504f38343be18bdd8ecd861bcd76f29ab4dd9645505a032cc3352ca

Download Submit
\Users\Admin\AppData\Local\ISL Online Cache\ISL Light\1\ISLLight.exe

Filesize
22.8MB

MD5
b654b60c47e5d034a074552220f04054

SHA1
5ef13e9c3b9faf5e8f1fd63a227fc2da6d7c6b98

SHA256
01c1bc88cf97d11d15257fb4b27486552898569dc73fdaa6e56b799d28febaa3

SHA512
1903a9d3ab07dfd1aa1f700a26fe6dae8a12559b0acf3dc30f697499167cf35ca1586c6d2504f38343be18bdd8ecd861bcd76f29ab4dd9645505a032cc3352ca

Download Submit
\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\ISLNetworkStart.dll

Filesize
1.3MB

MD5
02b937adeeb7019556af1cd6a078b6e1

SHA1
5a0a6965ef4b264a33326a6756fcf3370ededb8e

SHA256
e004033c67a336169166e22ea1abff438a620f93a784eec457062598456d9035

SHA512
59a29b25939c30462da30a2d51c1e2d50c1a20db951519810d980f992833868be1a8e5edd4616ab937872d1f4264e78f0a9e040a1d674616e77079ff8fcc9f42

Download Submit
\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\extract_1687681228_1304_924_1862629937\ISLLight_4_4_2234_59.exe

Filesize
13.6MB

MD5
31586ee036dbae8ce3da4656112111dd

SHA1
69759e43c56bb70d0d9bbb955429ce5043da74f8

SHA256
9ab2900cc6f23d8445c3004f03891fa4c620bd9a25f628f09485d669c173060f

SHA512
d03ba011d0ed6ed7e0706402b64517d37e274064f2fcc32afe3d418408451c428f3cbe31010fbad2af2784fdc06b1beabe85b175cc1f12e640514913b3a8d41d

Download Submit
memory/1000-303-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/1000-312-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/1000-236-0x0000000006970000-0x0000000006B70000-memory.dmp

Filesize
2.0MB

Download
memory/1000-286-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1000-285-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1000-284-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1000-283-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1000-290-0x0000000000440000-0x0000000000441000-memory.dmp

Filesize
4KB

Download
memory/1000-291-0x0000000000440000-0x0000000000441000-memory.dmp

Filesize
4KB

Download
memory/1000-300-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/1000-301-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/1000-164-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1000-304-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/1000-308-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/1000-309-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/1000-310-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/1000-311-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/1000-234-0x0000000006530000-0x0000000006970000-memory.dmp

Filesize
4.2MB

Download
memory/1000-315-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/1000-316-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/1000-317-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/1000-318-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/1000-319-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/1000-320-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/1000-321-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/1000-322-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/1000-323-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/1000-324-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/1000-325-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/1000-326-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/1000-351-0x0000000000AF0000-0x0000000000AFA000-memory.dmp

Filesize
40KB

Download
memory/1000-352-0x0000000000AF0000-0x0000000000AFA000-memory.dmp

Filesize
40KB

Download
memory/1000-407-0x0000000000AF0000-0x0000000000AFA000-memory.dmp

Filesize
40KB

Download
memory/1000-408-0x0000000000AF0000-0x0000000000AFA000-memory.dmp

Filesize
40KB

Download