raccoon | ca21d368d1f29efc9be3158e0bacbe66640dba8ed3cdf9ba9f6a485a2664cf05

General

Target

ca21d368d1f29efc9be3158e0bacbe66640dba8ed3cdf9ba9f6a485a2664cf05.exe
Size

1.6MB
MD5

1bff2e1095c5000b950c2f9bcde896e5
SHA1

fc61d68aa844f8a3cf8e879ea0005c009560b306
SHA256

ca21d368d1f29efc9be3158e0bacbe66640dba8ed3cdf9ba9f6a485a2664cf05
SHA512

6339f59483fb86b402392171fc11ddaf27d805bec29cb088bb0efed1a1d29f7548a6151398344969486d02ba6e32155c0b58452570f0c031207e4eeabf01db0b
SSDEEP

24576:3CGKLOvnkRd/WMqXqCb4VKMseaIuNCXmcPUHQCSIdf+ZkY0rHOmUK7DVqZ:3IsS/WMqXqWMdad3LhddEaHOfo

Score

10^/10

raccoon 111a83bc76cd8d221f67303e6ef70a11 credential_access discovery spyware stealer

Malware Config

Extracted

Family

raccoon

Botnet

111a83bc76cd8d221f67303e6ef70a11

C2

http://192.153.57.177:80

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 3 IoCs

resource	yara_rule
behavioral1/memory/5068-5-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral1/memory/5068-8-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral1/memory/5068-86-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
1768	A4d6YAqs.exe
452	oobeldr.exe

Loads dropped DLL 3 IoCs

pid	Process
5068	MSBuild.exe
5068	MSBuild.exe
5068	MSBuild.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2036 set thread context of 5068	2036	ca21d368d1f29efc9be3158e0bacbe66640dba8ed3cdf9ba9f6a485a2664cf05.exe	85

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oobeldr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ca21d368d1f29efc9be3158e0bacbe66640dba8ed3cdf9ba9f6a485a2664cf05.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A4d6YAqs.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
396	schtasks.exe
4864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5068	MSBuild.exe
5068	MSBuild.exe
5068	MSBuild.exe
5068	MSBuild.exe
5068	MSBuild.exe
5068	MSBuild.exe
5068	MSBuild.exe
5068	MSBuild.exe
5068	MSBuild.exe
5068	MSBuild.exe
5068	MSBuild.exe
5068	MSBuild.exe
5068	MSBuild.exe
5068	MSBuild.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 5068	2036	ca21d368d1f29efc9be3158e0bacbe66640dba8ed3cdf9ba9f6a485a2664cf05.exe	85
PID 2036 wrote to memory of 5068	2036	ca21d368d1f29efc9be3158e0bacbe66640dba8ed3cdf9ba9f6a485a2664cf05.exe	85
PID 2036 wrote to memory of 5068	2036	ca21d368d1f29efc9be3158e0bacbe66640dba8ed3cdf9ba9f6a485a2664cf05.exe	85
PID 2036 wrote to memory of 5068	2036	ca21d368d1f29efc9be3158e0bacbe66640dba8ed3cdf9ba9f6a485a2664cf05.exe	85
PID 2036 wrote to memory of 5068	2036	ca21d368d1f29efc9be3158e0bacbe66640dba8ed3cdf9ba9f6a485a2664cf05.exe	85
PID 2036 wrote to memory of 5068	2036	ca21d368d1f29efc9be3158e0bacbe66640dba8ed3cdf9ba9f6a485a2664cf05.exe	85
PID 2036 wrote to memory of 5068	2036	ca21d368d1f29efc9be3158e0bacbe66640dba8ed3cdf9ba9f6a485a2664cf05.exe	85
PID 2036 wrote to memory of 5068	2036	ca21d368d1f29efc9be3158e0bacbe66640dba8ed3cdf9ba9f6a485a2664cf05.exe	85
PID 5068 wrote to memory of 1768	5068	MSBuild.exe	93
PID 5068 wrote to memory of 1768	5068	MSBuild.exe	93
PID 5068 wrote to memory of 1768	5068	MSBuild.exe	93
PID 1768 wrote to memory of 396	1768	A4d6YAqs.exe	94
PID 1768 wrote to memory of 396	1768	A4d6YAqs.exe	94
PID 1768 wrote to memory of 396	1768	A4d6YAqs.exe	94
PID 452 wrote to memory of 4864	452	oobeldr.exe	101
PID 452 wrote to memory of 4864	452	oobeldr.exe	101
PID 452 wrote to memory of 4864	452	oobeldr.exe	101

C:\Users\Admin\AppData\Local\Temp\ca21d368d1f29efc9be3158e0bacbe66640dba8ed3cdf9ba9f6a485a2664cf05.exe
"C:\Users\Admin\AppData\Local\Temp\ca21d368d1f29efc9be3158e0bacbe66640dba8ed3cdf9ba9f6a485a2664cf05.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Users\Admin\AppData\Roaming\A4d6YAqs.exe
    "C:\Users\Admin\AppData\Roaming\A4d6YAqs.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:396

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:452
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\4ptXSfUl6927

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\LocalLow\mozglue.dll

Filesize
612KB

MD5
f07d9977430e762b563eaadc2b94bbfa

SHA1
da0a05b2b8d269fb73558dfcf0ed5c167f6d3877

SHA256
4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862

SHA512
6afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf

Download Submit
C:\Users\Admin\AppData\LocalLow\nss3.dll

Filesize
1.9MB

MD5
f67d08e8c02574cbc2f1122c53bfb976

SHA1
6522992957e7e4d074947cad63189f308a80fcf2

SHA256
c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e

SHA512
2e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5

Download Submit
C:\Users\Admin\AppData\LocalLow\sqlite3.dll

Filesize
1.0MB

MD5
dbf4f8dcefb8056dc6bae4b67ff810ce

SHA1
bbac1dd8a07c6069415c04b62747d794736d0689

SHA256
47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68

SHA512
b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1

Download Submit
C:\Users\Admin\AppData\LocalLow\sue8rJMR01rZ

Filesize
114KB

MD5
35fb57f056b0f47185c5dfb9a0939dba

SHA1
7c1b0bbbb77dbe46286078bca427202d494a5d36

SHA256
1dc436687ed65d9f2fcda9a68a812346f56f566f7671cbe1be0beaa157045294

SHA512
531351adffddc5a9c8c9d1fcba531d85747be0927156bae79106114b4bdc3f2fd2570c97bbfcec09265dcc87ed286655f2ab15fb3c7af0ad638a67a738f504c7

Download Submit
C:\Users\Admin\AppData\Roaming\A4d6YAqs.exe

Filesize
4.4MB

MD5
af6e384dfabdad52d43cf8429ad8779c

SHA1
c78e8cd8c74ad9d598f591de5e49f73ce3373791

SHA256
f327c2b5ab1d98f0382a35cd78f694d487c74a7290f1ff7be53f42e23021e599

SHA512
b55ba87b275a475e751e13ec9bac2e7f1a3484057844e210168e2256d73d9b6a7c7c7592845d4a3bf8163cf0d479315418a9f3cb8f2f4832af88a06867e3df93

Download Submit
memory/452-94-0x0000000000400000-0x0000000000BD9000-memory.dmp

Filesize
7.8MB

Download
memory/452-92-0x0000000000400000-0x0000000000BD9000-memory.dmp

Filesize
7.8MB

Download
memory/1768-83-0x0000000000400000-0x0000000000BD9000-memory.dmp

Filesize
7.8MB

Download
memory/1768-81-0x0000000000400000-0x0000000000BD9000-memory.dmp

Filesize
7.8MB

Download
memory/1768-82-0x0000000000400000-0x0000000000BD9000-memory.dmp

Filesize
7.8MB

Download
memory/1768-88-0x0000000000400000-0x0000000000BD9000-memory.dmp

Filesize
7.8MB

Download
memory/2036-4-0x0000000004DD0000-0x0000000004DF2000-memory.dmp

Filesize
136KB

Download
memory/2036-3-0x0000000004EF0000-0x0000000004FD4000-memory.dmp

Filesize
912KB

Download
memory/2036-0-0x0000000074E4E000-0x0000000074E4F000-memory.dmp

Filesize
4KB

Download
memory/2036-2-0x0000000004E00000-0x0000000004E9C000-memory.dmp

Filesize
624KB

Download
memory/2036-1-0x0000000000280000-0x0000000000422000-memory.dmp

Filesize
1.6MB

Download
memory/5068-8-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/5068-5-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/5068-86-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads