raccoon | 9998a13c9765059b9bb6dc9795b5af7d83a575b1994bd455a9cfc890a8f8f055

General

Target

ISLLightexe.exe
Size

591KB
MD5

0c7b1b300029227ec246a0c51034bcba
SHA1

e3d02142d073267b9e723fe20b8f8cf1ca1446bb
SHA256

9998a13c9765059b9bb6dc9795b5af7d83a575b1994bd455a9cfc890a8f8f055
SHA512

bbb81c66f39789eb64dd67f52c3c5cb40ce50c4e89bda40fbc5751ff4e796779c16b8257a15e930ee318b8b36d1995a89f05149475a43da346849c18f6e3ca70
SSDEEP

12288:j9m4MBiB/6tV1C8tCeRuaqRK2opT7sQ2qN+VN6BUzNt6Oa4n5I:j9m4PBStV/CeHqRKj7R2K+OGt6In+

Score

10^/10

raccoon stealer

Malware Config

Extracted

Family

raccoon

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ISLLight_4_4_2234_59.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Control Panel\International\Geo\Nation	ISLLight_4_4_2234_59.exe

Executes dropped EXE 2 IoCs

Processes:

ISLLight_4_4_2234_59.exeISLLight.exe

pid process

3988 ISLLight_4_4_2234_59.exe
2872 ISLLight.exe
Loads dropped DLL 1 IoCs

Processes:

ISLLightexe.exe

pid process

1652 ISLLightexe.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

ISLLight.exe

pid process

2872 ISLLight.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ISLLight.exe

pid process

2872 ISLLight.exe

pid	process
3988	ISLLight_4_4_2234_59.exe
2872	ISLLight.exe

pid	process
1652	ISLLightexe.exe

pid	process
2872	ISLLight.exe

pid	process
2872	ISLLight.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ISLLightexe.exeISLLight_4_4_2234_59.exe

description	pid	process	target process
PID 1652 wrote to memory of 3988	1652	ISLLightexe.exe	ISLLight_4_4_2234_59.exe
PID 1652 wrote to memory of 3988	1652	ISLLightexe.exe	ISLLight_4_4_2234_59.exe
PID 1652 wrote to memory of 3988	1652	ISLLightexe.exe	ISLLight_4_4_2234_59.exe
PID 3988 wrote to memory of 2872	3988	ISLLight_4_4_2234_59.exe	ISLLight.exe
PID 3988 wrote to memory of 2872	3988	ISLLight_4_4_2234_59.exe	ISLLight.exe
PID 3988 wrote to memory of 2872	3988	ISLLight_4_4_2234_59.exe	ISLLight.exe

C:\Users\Admin\AppData\Local\Temp\ISLLightexe.exe
"C:\Users\Admin\AppData\Local\Temp\ISLLightexe.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\extract_1687688427_1652_4924_788143590\ISLLight_4_4_2234_59.exe
  ISLLight_4_4_2234_59.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Light\1\ISLLight.exe
    "C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Light\1\ISLLight.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:2872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Light\1\ISLLight.exe

Filesize
22.8MB

MD5
b654b60c47e5d034a074552220f04054

SHA1
5ef13e9c3b9faf5e8f1fd63a227fc2da6d7c6b98

SHA256
01c1bc88cf97d11d15257fb4b27486552898569dc73fdaa6e56b799d28febaa3

SHA512
1903a9d3ab07dfd1aa1f700a26fe6dae8a12559b0acf3dc30f697499167cf35ca1586c6d2504f38343be18bdd8ecd861bcd76f29ab4dd9645505a032cc3352ca

Download Submit
C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\ISLNetworkStart.dll

Filesize
1.3MB

MD5
02b937adeeb7019556af1cd6a078b6e1

SHA1
5a0a6965ef4b264a33326a6756fcf3370ededb8e

SHA256
e004033c67a336169166e22ea1abff438a620f93a784eec457062598456d9035

SHA512
59a29b25939c30462da30a2d51c1e2d50c1a20db951519810d980f992833868be1a8e5edd4616ab937872d1f4264e78f0a9e040a1d674616e77079ff8fcc9f42

Download Submit
C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\extract_1687688427_1652_4924_788143590\ISLLight_4_4_2234_59.exe

Filesize
13.6MB

MD5
31586ee036dbae8ce3da4656112111dd

SHA1
69759e43c56bb70d0d9bbb955429ce5043da74f8

SHA256
9ab2900cc6f23d8445c3004f03891fa4c620bd9a25f628f09485d669c173060f

SHA512
d03ba011d0ed6ed7e0706402b64517d37e274064f2fcc32afe3d418408451c428f3cbe31010fbad2af2784fdc06b1beabe85b175cc1f12e640514913b3a8d41d

Download Submit
C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\extract_1687688427_1652_4924_788143590\ISLLight_4_4_2234_59.exe

Filesize
13.6MB

MD5
31586ee036dbae8ce3da4656112111dd

SHA1
69759e43c56bb70d0d9bbb955429ce5043da74f8

SHA256
9ab2900cc6f23d8445c3004f03891fa4c620bd9a25f628f09485d669c173060f

SHA512
d03ba011d0ed6ed7e0706402b64517d37e274064f2fcc32afe3d418408451c428f3cbe31010fbad2af2784fdc06b1beabe85b175cc1f12e640514913b3a8d41d

Download Submit
C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\isl_network_start.log

Filesize
4KB

MD5
47cc720297ee9a317eaaa2474921125f

SHA1
f427e745512de865527e5f8aefcf0082e95dedf2

SHA256
5625d627e30fdfdff527df47faa58630ea0f97ee402b0e8ca2895103c11020c3

SHA512
bc0db35645763ecfc13949f8deed6bd6a47a9842fd8c60606a92ab9d5e3e5aea873f5bbb5e9c5b671c7e81de4e77723e5675a44ca629edf3f171a2fdd7cc159a

Download Submit
C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\isl_network_start.log

Filesize
24KB

MD5
0e55da5e3a27c0d3246a3b5d7c2f3e22

SHA1
ea3f20531171a5f29b7e7127fc878ef47c99e1a6

SHA256
52a78c03fdf4bb33c56e60b668d7e923e9f0093e0b4d27bd066e2dd265a12877

SHA512
9040f1008c9e530647934e264e0dffc8db1ca3b485d089cf3b45f9db11e781e15c98528378baf4b3c16f724ca86cef23c8b0fde6778ce9b62ed4f471ae418f81

Download Submit
memory/2872-346-0x000000000A7E0000-0x000000000A7E1000-memory.dmp

Filesize
4KB

Download
memory/2872-352-0x000000000A7E0000-0x000000000A7E1000-memory.dmp

Filesize
4KB

Download
memory/2872-305-0x0000000007010000-0x0000000007210000-memory.dmp

Filesize
2.0MB

Download
memory/2872-323-0x000000000A2A0000-0x000000000A2A1000-memory.dmp

Filesize
4KB

Download
memory/2872-325-0x000000000A2A0000-0x000000000A2A1000-memory.dmp

Filesize
4KB

Download
memory/2872-326-0x000000000A2A0000-0x000000000A2A1000-memory.dmp

Filesize
4KB

Download
memory/2872-327-0x000000000A2A0000-0x000000000A2A1000-memory.dmp

Filesize
4KB

Download
memory/2872-334-0x000000000A6A0000-0x000000000A6A1000-memory.dmp

Filesize
4KB

Download
memory/2872-335-0x000000000A6A0000-0x000000000A6A1000-memory.dmp

Filesize
4KB

Download
memory/2872-340-0x000000000A7D0000-0x000000000A7D1000-memory.dmp

Filesize
4KB

Download
memory/2872-341-0x000000000A7D0000-0x000000000A7D1000-memory.dmp

Filesize
4KB

Download
memory/2872-343-0x000000000A7E0000-0x000000000A7E1000-memory.dmp

Filesize
4KB

Download
memory/2872-281-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/2872-350-0x000000000A7E0000-0x000000000A7E1000-memory.dmp

Filesize
4KB

Download
memory/2872-351-0x000000000A7E0000-0x000000000A7E1000-memory.dmp

Filesize
4KB

Download
memory/2872-303-0x0000000006BD0000-0x0000000007010000-memory.dmp

Filesize
4.2MB

Download
memory/2872-353-0x000000000A7E0000-0x000000000A7E1000-memory.dmp

Filesize
4KB

Download
memory/2872-354-0x000000000A7E0000-0x000000000A7E1000-memory.dmp

Filesize
4KB

Download
memory/2872-357-0x000000000ACA0000-0x000000000ACA1000-memory.dmp

Filesize
4KB

Download
memory/2872-358-0x000000000A7E0000-0x000000000A7E1000-memory.dmp

Filesize
4KB

Download
memory/2872-360-0x000000000A7E0000-0x000000000A7E1000-memory.dmp

Filesize
4KB

Download
memory/2872-359-0x000000000A7E0000-0x000000000A7E1000-memory.dmp

Filesize
4KB

Download
memory/2872-361-0x000000000ACA0000-0x000000000ACA1000-memory.dmp

Filesize
4KB

Download
memory/2872-362-0x000000000A7E0000-0x000000000A7E1000-memory.dmp

Filesize
4KB

Download
memory/2872-365-0x000000000A7E0000-0x000000000A7E1000-memory.dmp

Filesize
4KB

Download
memory/2872-363-0x000000000A7E0000-0x000000000A7E1000-memory.dmp

Filesize
4KB

Download
memory/2872-366-0x000000000ACA0000-0x000000000ACA1000-memory.dmp

Filesize
4KB

Download
memory/2872-368-0x000000000ACA0000-0x000000000ACA1000-memory.dmp

Filesize
4KB

Download
memory/2872-367-0x000000000ACA0000-0x000000000ACA1000-memory.dmp

Filesize
4KB

Download
memory/2872-369-0x000000000ACA0000-0x000000000ACA1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing