Raccoon Stealer v2

MITRE ATT&CK Mapping Tactic Technique ID Application Initial Access Drive-by Compromise T1189 ClearFake JavaScript injection on compromised websites

the extracted EXE inside of it ends up being a simple .NET based loader which will download and execute more .NET code, eventually this leads to Racoon Stealer V2

Stage 3: PowerShell Payload Download The PSF start script chrome.ps1 executes

the command and control server provides information on where to download additional payloads from and which IP Address to use for further communications.

MITRE ATT&CK Mapping Tactic Technique ID Application Initial Access Drive-by Compromise T1189 ClearFake JavaScript injection on compromised websites Execution User Execution: Malicious File T1204.002 Victim installs MSIX package from fake update prompt

[PsfRuntime32.dll / PsfRuntime64.dll] |-- Process injection via CreateProcess + GetThreadContext |-- Microsoft Detours library for API hooking

The routine is simple. RC4 encrypted strings are stored in the sample with base64 encoding. The sample first decodes the base64 encoding and then decrypts the encrypted string with the key ‘ edinayarossiya ’.

MITRE ATT&CK Mapping ... Defense Evasion Obfuscated Files: Software Packing T1027.002 LZMA-compressed NSIS installer in PE overlay

We have also seen a change in how Raccoon Stealer v2 hides its intentions by using a mechanism where API names are dynamically resolved rather than being loaded statically. The stealer uses LoadLibraryW and GetProcAddress to resolve each of the necessary functions.

[PsfRuntime32.dll / PsfRuntime64.dll] |-- Process injection via CreateProcess + GetThreadContext |-- Microsoft Detours library for API hooking

The malware gets a handle on mutex and checks if it matches a particular value or not. If it matches, the malware continues execution. Value : 8724643052. This technique is used to make sure only one instance of malware is running at one time.

The malware also checks if it is running as SYSTEM by comparing the current process’s token to the SYSTEM SID, S-1–5–18.

It is at this point that the malware would perform the bulk of its stealing functionality, including cookies, passwords, credit card data, passwords, browser history, etc.

It is at this point that the malware would perform the bulk of its stealing functionality, including cookies, passwords, credit card data, passwords, browser history, etc.

This file is a self extracting EXE signed by ‘Nir Sofer’

Before connecting to the C2 node, the malware will retrieve the host’s GUID by querying the SOFTWARE\Microsoft\Cryptography registry key.

Figure 17 depicts malware using the GetUserNameW function to retrieve a username.

If running as a SYSTEM user, the enumeration of all the running processes is done with the help of fun_CreateToolhelp32Snapshot.

Figure 16 depicts the malware retrieving the Machine ID from the registry key " SOFTWAREMicrosoftCryptography " via the RegQueryKeyExW and RegQueryValueExW functions.

The malware also checks if it is running as SYSTEM by comparing the current process’s token to the SYSTEM SID, S-1–5–18.

It is at this point that the malware would perform the bulk of its stealing functionality, including cookies, passwords, credit card data, passwords, browser history, etc.

The malware uses a WINAPI call to SHGetFolderPathW to get a path to C:\Users\ \AppData and appends “Local” to it and uses it as the path to store stolen information before sending it to the command and control.

Communication with command and control takes place over plain text http protocol.

First the malware uses the WideCharToMultiByte API function to form all of the parameters it needs in order to connect to the C2 node, including the machineID, username, and configID parameters which will be sent to the C2 node via POST request.

The recovered tasks are as follows: Location: http://rgyui.top/dl/buildz.exe Location: https://dl.uploadgram.me/62e817d1aff5ah?dl Location: https://allejee.com/bulking.exe Location: http://194.87.31.137/7loader_exe_64.exe Location: http://2.58.28.60/csflow.exe

Once all the overhead of setting up the functions and decryption of the strings is done, the malware will perform some checks before contacting the command and control server to download malicious DLLs and exfiltrate information.