raccoon | 9998a13c9765059b9bb6dc9795b5af7d83a575b1994bd455a9cfc890a8f8f055

General

Target

ISL Light.exe
Size

591KB
MD5

0c7b1b300029227ec246a0c51034bcba
SHA1

e3d02142d073267b9e723fe20b8f8cf1ca1446bb
SHA256

9998a13c9765059b9bb6dc9795b5af7d83a575b1994bd455a9cfc890a8f8f055
SHA512

bbb81c66f39789eb64dd67f52c3c5cb40ce50c4e89bda40fbc5751ff4e796779c16b8257a15e930ee318b8b36d1995a89f05149475a43da346849c18f6e3ca70
SSDEEP

12288:j9m4MBiB/6tV1C8tCeRuaqRK2opT7sQ2qN+VN6BUzNt6Oa4n5I:j9m4PBStV/CeHqRKj7R2K+OGt6In+

Score

10^/10

raccoon stealer

Malware Config

Extracted

Family

raccoon

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ISLLight_4_4_2234_59.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000\Control Panel\International\Geo\Nation	ISLLight_4_4_2234_59.exe

Executes dropped EXE 2 IoCs

Processes:

ISLLight_4_4_2234_59.exeISLLight.exe

pid process

2740 ISLLight_4_4_2234_59.exe
4288 ISLLight.exe
Loads dropped DLL 1 IoCs

Processes:

ISL Light.exe

pid process

3568 ISL Light.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

ISLLight.exe

pid process

4288 ISLLight.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ISLLight.exe

pid process

4288 ISLLight.exe

pid	process
2740	ISLLight_4_4_2234_59.exe
4288	ISLLight.exe

pid	process
3568	ISL Light.exe

pid	process
4288	ISLLight.exe

pid	process
4288	ISLLight.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ISL Light.exeISLLight_4_4_2234_59.exe

description	pid	process	target process
PID 3568 wrote to memory of 2740	3568	ISL Light.exe	ISLLight_4_4_2234_59.exe
PID 3568 wrote to memory of 2740	3568	ISL Light.exe	ISLLight_4_4_2234_59.exe
PID 3568 wrote to memory of 2740	3568	ISL Light.exe	ISLLight_4_4_2234_59.exe
PID 2740 wrote to memory of 4288	2740	ISLLight_4_4_2234_59.exe	ISLLight.exe
PID 2740 wrote to memory of 4288	2740	ISLLight_4_4_2234_59.exe	ISLLight.exe
PID 2740 wrote to memory of 4288	2740	ISLLight_4_4_2234_59.exe	ISLLight.exe

C:\Users\Admin\AppData\Local\Temp\ISL Light.exe
"C:\Users\Admin\AppData\Local\Temp\ISL Light.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\extract_1687681227_3568_5000_669904753\ISLLight_4_4_2234_59.exe
  ISLLight_4_4_2234_59.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Light\1\ISLLight.exe
    "C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Light\1\ISLLight.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:4288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Light\1\ISLLight.exe

Filesize
22.8MB

MD5
b654b60c47e5d034a074552220f04054

SHA1
5ef13e9c3b9faf5e8f1fd63a227fc2da6d7c6b98

SHA256
01c1bc88cf97d11d15257fb4b27486552898569dc73fdaa6e56b799d28febaa3

SHA512
1903a9d3ab07dfd1aa1f700a26fe6dae8a12559b0acf3dc30f697499167cf35ca1586c6d2504f38343be18bdd8ecd861bcd76f29ab4dd9645505a032cc3352ca

Download Submit
C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\ISLNetworkStart.dll

Filesize
1.3MB

MD5
02b937adeeb7019556af1cd6a078b6e1

SHA1
5a0a6965ef4b264a33326a6756fcf3370ededb8e

SHA256
e004033c67a336169166e22ea1abff438a620f93a784eec457062598456d9035

SHA512
59a29b25939c30462da30a2d51c1e2d50c1a20db951519810d980f992833868be1a8e5edd4616ab937872d1f4264e78f0a9e040a1d674616e77079ff8fcc9f42

Download Submit
C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\extract_1687681227_3568_5000_669904753\ISLLight_4_4_2234_59.exe

Filesize
13.6MB

MD5
31586ee036dbae8ce3da4656112111dd

SHA1
69759e43c56bb70d0d9bbb955429ce5043da74f8

SHA256
9ab2900cc6f23d8445c3004f03891fa4c620bd9a25f628f09485d669c173060f

SHA512
d03ba011d0ed6ed7e0706402b64517d37e274064f2fcc32afe3d418408451c428f3cbe31010fbad2af2784fdc06b1beabe85b175cc1f12e640514913b3a8d41d

Download Submit
C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\extract_1687681227_3568_5000_669904753\ISLLight_4_4_2234_59.exe

Filesize
13.6MB

MD5
31586ee036dbae8ce3da4656112111dd

SHA1
69759e43c56bb70d0d9bbb955429ce5043da74f8

SHA256
9ab2900cc6f23d8445c3004f03891fa4c620bd9a25f628f09485d669c173060f

SHA512
d03ba011d0ed6ed7e0706402b64517d37e274064f2fcc32afe3d418408451c428f3cbe31010fbad2af2784fdc06b1beabe85b175cc1f12e640514913b3a8d41d

Download Submit
C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\isl_network_start.log

Filesize
4KB

MD5
d00f514ca7137d1b400dee2f307b997a

SHA1
312446b938b25b610312f8158be7a5aa672ecb68

SHA256
2319d31cfe55666a516925a54f310935090dfcaf3d1e415904233c1a6cc66d0d

SHA512
6031cfeffcb8da96c19daf8a4a9627810b8e5e86af1a4715fa3e3579a3a4b3d04be062855d5d0f62ddc31b79730970e9862b45ff133575a4c1bbab232420bceb

Download Submit
C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\isl_network_start.log

Filesize
23KB

MD5
c058370b8892f324388b28a153f094e6

SHA1
ccba7f3be995ecca8e82382d89a7a27a3e596782

SHA256
aa90d95d28ce36d07bf7b147ded7076ff4c1b0a2ee324261ab2082955b83b24d

SHA512
f6d73883627d6f15564c7c623e913212633504c88d222c03b7efbe01bf81daedf4162324cccdf227db8d5a9fe5fe1010060c53cea7c15c71c2e465dd668142b7

Download Submit
memory/4288-351-0x000000000A270000-0x000000000A271000-memory.dmp

Filesize
4KB

Download
memory/4288-359-0x000000000A270000-0x000000000A271000-memory.dmp

Filesize
4KB

Download
memory/4288-309-0x0000000006C30000-0x0000000006E30000-memory.dmp

Filesize
2.0MB

Download
memory/4288-329-0x000000000A110000-0x000000000A111000-memory.dmp

Filesize
4KB

Download
memory/4288-330-0x000000000A110000-0x000000000A111000-memory.dmp

Filesize
4KB

Download
memory/4288-331-0x000000000A110000-0x000000000A111000-memory.dmp

Filesize
4KB

Download
memory/4288-332-0x000000000A110000-0x000000000A111000-memory.dmp

Filesize
4KB

Download
memory/4288-337-0x000000000A140000-0x000000000A141000-memory.dmp

Filesize
4KB

Download
memory/4288-338-0x000000000A140000-0x000000000A141000-memory.dmp

Filesize
4KB

Download
memory/4288-346-0x000000000A260000-0x000000000A261000-memory.dmp

Filesize
4KB

Download
memory/4288-347-0x000000000A260000-0x000000000A261000-memory.dmp

Filesize
4KB

Download
memory/4288-349-0x000000000A270000-0x000000000A271000-memory.dmp

Filesize
4KB

Download
memory/4288-268-0x0000000000C90000-0x0000000000C91000-memory.dmp

Filesize
4KB

Download
memory/4288-357-0x000000000A270000-0x000000000A271000-memory.dmp

Filesize
4KB

Download
memory/4288-356-0x000000000A270000-0x000000000A271000-memory.dmp

Filesize
4KB

Download
memory/4288-307-0x00000000067F0000-0x0000000006C30000-memory.dmp

Filesize
4.2MB

Download
memory/4288-358-0x000000000A270000-0x000000000A271000-memory.dmp

Filesize
4KB

Download
memory/4288-360-0x000000000A270000-0x000000000A271000-memory.dmp

Filesize
4KB

Download
memory/4288-363-0x000000000A730000-0x000000000A731000-memory.dmp

Filesize
4KB

Download
memory/4288-365-0x000000000A270000-0x000000000A271000-memory.dmp

Filesize
4KB

Download
memory/4288-364-0x000000000A270000-0x000000000A271000-memory.dmp

Filesize
4KB

Download
memory/4288-366-0x000000000A270000-0x000000000A271000-memory.dmp

Filesize
4KB

Download
memory/4288-367-0x000000000A730000-0x000000000A731000-memory.dmp

Filesize
4KB

Download
memory/4288-368-0x000000000A270000-0x000000000A271000-memory.dmp

Filesize
4KB

Download
memory/4288-369-0x000000000A270000-0x000000000A271000-memory.dmp

Filesize
4KB

Download
memory/4288-370-0x000000000A270000-0x000000000A271000-memory.dmp

Filesize
4KB

Download
memory/4288-371-0x000000000A730000-0x000000000A731000-memory.dmp

Filesize
4KB

Download
memory/4288-372-0x000000000A730000-0x000000000A731000-memory.dmp

Filesize
4KB

Download
memory/4288-373-0x000000000A730000-0x000000000A731000-memory.dmp

Filesize
4KB

Download
memory/4288-374-0x000000000A730000-0x000000000A731000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing