raccoon | ca21d368d1f29efc9be3158e0bacbe66640dba8ed3cdf9ba9f6a485a2664cf05

General

Target

file.exe
Size

1.6MB
MD5

1bff2e1095c5000b950c2f9bcde896e5
SHA1

fc61d68aa844f8a3cf8e879ea0005c009560b306
SHA256

ca21d368d1f29efc9be3158e0bacbe66640dba8ed3cdf9ba9f6a485a2664cf05
SHA512

6339f59483fb86b402392171fc11ddaf27d805bec29cb088bb0efed1a1d29f7548a6151398344969486d02ba6e32155c0b58452570f0c031207e4eeabf01db0b
SSDEEP

24576:3CGKLOvnkRd/WMqXqCb4VKMseaIuNCXmcPUHQCSIdf+ZkY0rHOmUK7DVqZ:3IsS/WMqXqWMdad3LhddEaHOfo

Score

10^/10

raccoon 111a83bc76cd8d221f67303e6ef70a11 credential_access discovery spyware stealer

Malware Config

Extracted

Family

raccoon

Botnet

111a83bc76cd8d221f67303e6ef70a11

C2

http://192.153.57.177:80

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2356-5-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/2356-8-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/2356-69-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

V2T2cLWw.exeoobeldr.exe

pid process

3984 V2T2cLWw.exe
1700 oobeldr.exe
Loads dropped DLL 3 IoCs

Processes:

MSBuild.exe

pid process

2356 MSBuild.exe
2356 MSBuild.exe
2356 MSBuild.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 3816 set thread context of 2356 3816 file.exe MSBuild.exe

pid	process
3984	V2T2cLWw.exe
1700	oobeldr.exe

description	pid	process	target process
PID 3816 set thread context of 2356	3816	file.exe	MSBuild.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

V2T2cLWw.exeschtasks.exeoobeldr.exeschtasks.exefile.exeMSBuild.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	V2T2cLWw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oobeldr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

4404 schtasks.exe
4792 schtasks.exe

pid	process
4404	schtasks.exe
4792	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

MSBuild.exe

pid	process
2356	MSBuild.exe
2356	MSBuild.exe
2356	MSBuild.exe
2356	MSBuild.exe
2356	MSBuild.exe
2356	MSBuild.exe
2356	MSBuild.exe
2356	MSBuild.exe
2356	MSBuild.exe
2356	MSBuild.exe
2356	MSBuild.exe
2356	MSBuild.exe
2356	MSBuild.exe
2356	MSBuild.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

file.exeMSBuild.exeV2T2cLWw.exeoobeldr.exe

description	pid	process	target process
PID 3816 wrote to memory of 2356	3816	file.exe	MSBuild.exe
PID 3816 wrote to memory of 2356	3816	file.exe	MSBuild.exe
PID 3816 wrote to memory of 2356	3816	file.exe	MSBuild.exe
PID 3816 wrote to memory of 2356	3816	file.exe	MSBuild.exe
PID 3816 wrote to memory of 2356	3816	file.exe	MSBuild.exe
PID 3816 wrote to memory of 2356	3816	file.exe	MSBuild.exe
PID 3816 wrote to memory of 2356	3816	file.exe	MSBuild.exe
PID 3816 wrote to memory of 2356	3816	file.exe	MSBuild.exe
PID 2356 wrote to memory of 3984	2356	MSBuild.exe	V2T2cLWw.exe
PID 2356 wrote to memory of 3984	2356	MSBuild.exe	V2T2cLWw.exe
PID 2356 wrote to memory of 3984	2356	MSBuild.exe	V2T2cLWw.exe
PID 3984 wrote to memory of 4404	3984	V2T2cLWw.exe	schtasks.exe
PID 3984 wrote to memory of 4404	3984	V2T2cLWw.exe	schtasks.exe
PID 3984 wrote to memory of 4404	3984	V2T2cLWw.exe	schtasks.exe
PID 1700 wrote to memory of 4792	1700	oobeldr.exe	schtasks.exe
PID 1700 wrote to memory of 4792	1700	oobeldr.exe	schtasks.exe
PID 1700 wrote to memory of 4792	1700	oobeldr.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Users\Admin\AppData\Roaming\V2T2cLWw.exe
    "C:\Users\Admin\AppData\Roaming\V2T2cLWw.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3984
  - - C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4404

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\O08m4y04gDR6

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\LocalLow\e4tPO8GX2NW1

Filesize
114KB

MD5
f0b6304b7b1d85d077205e5df561164a

SHA1
186d8f4596689a9a614cf47fc85f90f0b8704ffe

SHA256
c3aa800492bc1e5ff4717db8c82d1f3772b24579cde51058bdd73a9cc9822dc7

SHA512
d672ea182ddf56a331d3209dcf7b9af8c3ffad0b787b224fe9e3e4c80205e474a66914358fa253c170c85a8366da2f2c3aa9d42e1f6f3291a9e6bdd9ba51fb0a

Download Submit
C:\Users\Admin\AppData\LocalLow\mozglue.dll

Filesize
612KB

MD5
f07d9977430e762b563eaadc2b94bbfa

SHA1
da0a05b2b8d269fb73558dfcf0ed5c167f6d3877

SHA256
4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862

SHA512
6afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf

Download Submit
C:\Users\Admin\AppData\LocalLow\nss3.dll

Filesize
1.9MB

MD5
f67d08e8c02574cbc2f1122c53bfb976

SHA1
6522992957e7e4d074947cad63189f308a80fcf2

SHA256
c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e

SHA512
2e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5

Download Submit
C:\Users\Admin\AppData\LocalLow\sqlite3.dll

Filesize
1.0MB

MD5
dbf4f8dcefb8056dc6bae4b67ff810ce

SHA1
bbac1dd8a07c6069415c04b62747d794736d0689

SHA256
47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68

SHA512
b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1

Download Submit
C:\Users\Admin\AppData\Roaming\V2T2cLWw.exe

Filesize
4.4MB

MD5
af6e384dfabdad52d43cf8429ad8779c

SHA1
c78e8cd8c74ad9d598f591de5e49f73ce3373791

SHA256
f327c2b5ab1d98f0382a35cd78f694d487c74a7290f1ff7be53f42e23021e599

SHA512
b55ba87b275a475e751e13ec9bac2e7f1a3484057844e210168e2256d73d9b6a7c7c7592845d4a3bf8163cf0d479315418a9f3cb8f2f4832af88a06867e3df93

Download Submit
memory/1700-95-0x0000000000400000-0x0000000000BD9000-memory.dmp

Filesize
7.8MB

Download
memory/1700-93-0x0000000000400000-0x0000000000BD9000-memory.dmp

Filesize
7.8MB

Download
memory/2356-5-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2356-8-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2356-69-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2356-68-0x0000000061E00000-0x0000000061EF1000-memory.dmp

Filesize
964KB

Download
memory/3816-0-0x000000007448E000-0x000000007448F000-memory.dmp

Filesize
4KB

Download
memory/3816-4-0x0000000003450000-0x0000000003472000-memory.dmp

Filesize
136KB

Download
memory/3816-3-0x0000000005B70000-0x0000000005C54000-memory.dmp

Filesize
912KB

Download
memory/3816-2-0x0000000005AD0000-0x0000000005B6C000-memory.dmp

Filesize
624KB

Download
memory/3816-1-0x0000000000E90000-0x0000000001032000-memory.dmp

Filesize
1.6MB

Download
memory/3984-83-0x0000000000400000-0x0000000000BD9000-memory.dmp

Filesize
7.8MB

Download
memory/3984-84-0x0000000000400000-0x0000000000BD9000-memory.dmp

Filesize
7.8MB

Download
memory/3984-85-0x0000000000400000-0x0000000000BD9000-memory.dmp

Filesize
7.8MB

Download
memory/3984-89-0x0000000000400000-0x0000000000BD9000-memory.dmp

Filesize
7.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads