Overview

overview

10

Static

static

system32.bin.exe

windows7_x64

10

system32.bin.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    system32.bin

  • Size

    465KB

  • Sample

    201023-seh5a3qvyx

  • MD5

    049ef18418affcd542d9aa545bb07ee3

  • SHA1

    994b2b316ed112d81c697294405dcf15f9193deb

  • SHA256

    4d056b87049ec7fce672b40190bf8b5f9185395b7313d05bc196a655e7fe0c7a

  • SHA512

    ad0b3ab61327d0cc802d3512db80a60be264a52b8f0f750c9d83b4750d1373c59466d399da8650523d6e99723d75e962176ece9f669310f464844c5c2370886c

Score
10/10
raccoonb240f186dfcd9a0141345e239b4ac51800830ac0persistencestealer

Malware Config

Extracted

Family

raccoon

Attributes
  • url4cnc

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

b240f186dfcd9a0141345e239b4ac51800830ac0

Attributes
  • url4cnc

    https://drive.google.com/uc?export=download&id=19HMmBPaIPyhdlvzB7YPOENIFHwLz8Kkc

rc4.plain
rc4.plain

Targets

    • Target

      system32.bin

    • Size

      465KB

    • MD5

      049ef18418affcd542d9aa545bb07ee3

    • SHA1

      994b2b316ed112d81c697294405dcf15f9193deb

    • SHA256

      4d056b87049ec7fce672b40190bf8b5f9185395b7313d05bc196a655e7fe0c7a

    • SHA512

      ad0b3ab61327d0cc802d3512db80a60be264a52b8f0f750c9d83b4750d1373c59466d399da8650523d6e99723d75e962176ece9f669310f464844c5c2370886c

    Score
    10/10
    stealerraccoonpersistence

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • ServiceHost packer

      Detects ServiceHost packer used for .NET malware

    • Blacklisted process makes network request

    • Drops startup file

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Modifies service

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks