raccoon | f2a14fa74eb7d5752ecd5b578720883c3f48909e2fa81aaff1dbafff610e3257

General

Target

installer.exe
Size

735.1MB
MD5

f32cd33269e2eee752aa32c83b341d53
SHA1

4d7f4cd9e38248b1cb68357150b81faaeacd5380
SHA256

f732e864793731491b83cccd4a8e33d45370bb391ae3fd60f38a039cebb29749
SHA512

82bed41dd116031896ee02b5e2e8e89cfbdffc0bb647f58658c6fe274fe0b51ef2383cdb37091389c0b6d1e55682d64ebf70d6c612d7a651b7fe752b38817979
SSDEEP

393216:J5ExzGut0SaJ0qBFFov/pHoATlPykh3k3BEV38N/B:Ha6Eq3FGTlJ3Mo8VB

Score

10^/10

raccoon f0f70bdf46d27a5d3e549f9105928f1a discovery stealer

Malware Config

Extracted

Family

raccoon

Botnet

f0f70bdf46d27a5d3e549f9105928f1a

C2

http://87.120.37.15/

Attributes

user_agent
mozzzzzzzzzzz

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 4 IoCs

resource	yara_rule
behavioral2/memory/3636-36-0x0000000000ED0000-0x000000000197C000-memory.dmp	family_raccoon_v2
behavioral2/memory/3636-38-0x0000000000ED0000-0x000000000197C000-memory.dmp	family_raccoon_v2
behavioral2/memory/3636-39-0x0000000000ED0000-0x000000000197C000-memory.dmp	family_raccoon_v2
behavioral2/memory/3636-41-0x0000000000ED0000-0x000000000197C000-memory.dmp	family_raccoon_v2

Raccoon family
raccoon

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	installer.exe

Executes dropped EXE 1 IoCs

pid	Process
3636	ebrfsdf.exe_sBcev.exe

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4328-9-0x00000000002D0000-0x0000000001E41000-memory.dmp	autoit_exe
behavioral2/memory/4328-12-0x00000000002D0000-0x0000000001E41000-memory.dmp	autoit_exe
behavioral2/memory/4328-13-0x00000000002D0000-0x0000000001E41000-memory.dmp	autoit_exe
behavioral2/memory/4328-32-0x00000000002D0000-0x0000000001E41000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4328	installer.exe
4328	installer.exe
3636	ebrfsdf.exe_sBcev.exe
3636	ebrfsdf.exe_sBcev.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebrfsdf.exe_sBcev.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4328	installer.exe
4328	installer.exe
3636	ebrfsdf.exe_sBcev.exe
3636	ebrfsdf.exe_sBcev.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4328	installer.exe
4328	installer.exe
4328	installer.exe
4328	installer.exe
4328	installer.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
4328	installer.exe
4328	installer.exe
4328	installer.exe
4328	installer.exe
4328	installer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 3636	4328	installer.exe	86
PID 4328 wrote to memory of 3636	4328	installer.exe	86
PID 4328 wrote to memory of 3636	4328	installer.exe	86

C:\Users\Admin\AppData\Local\Temp\installer.exe
"C:\Users\Admin\AppData\Local\Temp\installer.exe"
1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4328
- C:\ProgramData\ebrfsdf.exe_sBcev.exe
  "C:\ProgramData\ebrfsdf.exe_sBcev.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\autD91A.tmp

Filesize
6.8MB

MD5
a64285b7c5e9aacd02714b59d65eacd7

SHA1
dd6042010ce4f8bc26843198c7c294b3f82fd7b9

SHA256
35ceeba35dd9cbefcd61e1d13df4d1f6b68047999501da3102966a42dbbc4c38

SHA512
83a1bd168b47d0821eba7ee24ed821afdba0eda6ebcfbd7561c2691eb5d7d8660fefd056728ad63bcf09824bed78f8f19d601a68dfcfd8c7eac917d0d3298c9d

Download Submit
memory/3636-41-0x0000000000ED0000-0x000000000197C000-memory.dmp

Filesize
10.7MB

Download
memory/3636-40-0x0000000000EDF000-0x00000000012B1000-memory.dmp

Filesize
3.8MB

Download
memory/3636-34-0x0000000001D60000-0x0000000001D61000-memory.dmp

Filesize
4KB

Download
memory/3636-39-0x0000000000ED0000-0x000000000197C000-memory.dmp

Filesize
10.7MB

Download
memory/3636-38-0x0000000000ED0000-0x000000000197C000-memory.dmp

Filesize
10.7MB

Download
memory/3636-35-0x00000000039E0000-0x00000000039E1000-memory.dmp

Filesize
4KB

Download
memory/3636-36-0x0000000000ED0000-0x000000000197C000-memory.dmp

Filesize
10.7MB

Download
memory/3636-33-0x0000000000EDF000-0x00000000012B1000-memory.dmp

Filesize
3.8MB

Download
memory/4328-4-0x0000000004F00000-0x0000000004F01000-memory.dmp

Filesize
4KB

Download
memory/4328-2-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/4328-13-0x00000000002D0000-0x0000000001E41000-memory.dmp

Filesize
27.4MB

Download
memory/4328-9-0x00000000002D0000-0x0000000001E41000-memory.dmp

Filesize
27.4MB

Download
memory/4328-31-0x00000000003A4000-0x0000000000F2D000-memory.dmp

Filesize
11.5MB

Download
memory/4328-32-0x00000000002D0000-0x0000000001E41000-memory.dmp

Filesize
27.4MB

Download
memory/4328-1-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/4328-12-0x00000000002D0000-0x0000000001E41000-memory.dmp

Filesize
27.4MB

Download
memory/4328-3-0x0000000002650000-0x0000000002651000-memory.dmp

Filesize
4KB

Download
memory/4328-0-0x00000000003A4000-0x0000000000F2D000-memory.dmp

Filesize
11.5MB

Download
memory/4328-5-0x0000000004F10000-0x0000000004F11000-memory.dmp

Filesize
4KB

Download
memory/4328-6-0x0000000004F20000-0x0000000004F21000-memory.dmp

Filesize
4KB

Download
memory/4328-7-0x0000000004F30000-0x0000000004F31000-memory.dmp

Filesize
4KB

Download
memory/4328-8-0x0000000004F40000-0x0000000004F41000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing