raccoon | d0b4ea79bfa3aad2d6343a52811b837c45229253cda7abb26b4df2107ab52d58

Analysis

max time kernel
14s
max time network
113s
platform
windows10_x64
resource
win10v20201028
submitted
08/03/2021, 13:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b3e9f226fa3385d959d9c9c7572e919f.exe
Size 1.5MB
Sample210308-mcwctx6pex
SHA256 d0b4ea79bfa3aad2d6343a52811b837c45229253cda7abb26b4df2107ab52d58
MD5 b3e9f226fa3385d959d9c9c7572e919f
SHA1 fcd70c339f3761e987894fa59cfb6f7237e92a56
SHA512 fb926389ff7ab88bcafe909645b40cf86b246b4c288fbf9943a7a604090b5e378eaecfe213e58cd7ae5fc91f59487f47c2f54815db0cc30b510c03bb7f7304a9
MD5 SHA1 SHA512

Score

10^/10

raccoon 0af651a4bbdfb570b08cae586e11f04751033448 stealer

Malware Config

Extracted

Family

raccoon

Botnet

0af651a4bbdfb570b08cae586e11f04751033448

Attributes

url4cnc
https://telete.in/jbitchsucks

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Executes dropped EXE 1 IoCs

pid	Process
2984	AddInProcess32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 988 set thread context of 2984	988	b3e9f226fa3385d959d9c9c7572e919f.exe	77

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3156	2984	WerFault.exe	77

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
988	b3e9f226fa3385d959d9c9c7572e919f.exe
988	b3e9f226fa3385d959d9c9c7572e919f.exe
3156	WerFault.exe
3156	WerFault.exe
3156	WerFault.exe
3156	WerFault.exe
3156	WerFault.exe
3156	WerFault.exe
3156	WerFault.exe
3156	WerFault.exe
3156	WerFault.exe
3156	WerFault.exe
3156	WerFault.exe
3156	WerFault.exe
3156	WerFault.exe
3156	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	988	b3e9f226fa3385d959d9c9c7572e919f.exe
Token: SeRestorePrivilege	3156	WerFault.exe
Token: SeBackupPrivilege	3156	WerFault.exe
Token: SeDebugPrivilege	3156	WerFault.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 2984	988	b3e9f226fa3385d959d9c9c7572e919f.exe	77
PID 988 wrote to memory of 2984	988	b3e9f226fa3385d959d9c9c7572e919f.exe	77
PID 988 wrote to memory of 2984	988	b3e9f226fa3385d959d9c9c7572e919f.exe	77
PID 988 wrote to memory of 2984	988	b3e9f226fa3385d959d9c9c7572e919f.exe	77
PID 988 wrote to memory of 2984	988	b3e9f226fa3385d959d9c9c7572e919f.exe	77
PID 988 wrote to memory of 2984	988	b3e9f226fa3385d959d9c9c7572e919f.exe	77
PID 988 wrote to memory of 2984	988	b3e9f226fa3385d959d9c9c7572e919f.exe	77
PID 988 wrote to memory of 2984	988	b3e9f226fa3385d959d9c9c7572e919f.exe	77
PID 988 wrote to memory of 2984	988	b3e9f226fa3385d959d9c9c7572e919f.exe	77

C:\Users\Admin\AppData\Local\Temp\b3e9f226fa3385d959d9c9c7572e919f.exe
"C:\Users\Admin\AppData\Local\Temp\b3e9f226fa3385d959d9c9c7572e919f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:988
- C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
  "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
  2⤵
  - Executes dropped EXE
  PID:2984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 544
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/988-7-0x0000000005410000-0x0000000005411000-memory.dmp

Download

memory/988-13-0x0000000005401000-0x0000000005402000-memory.dmp

Download

memory/988-2-0x0000000073800000-0x0000000073EEE000-memory.dmp

Download

memory/988-8-0x0000000005BF0000-0x0000000005BF1000-memory.dmp

Download

memory/988-9-0x00000000067E0000-0x00000000067E1000-memory.dmp

Download

memory/988-11-0x0000000005400000-0x0000000005401000-memory.dmp

Download

memory/988-12-0x0000000007030000-0x000000000705F000-memory.dmp

Download

memory/988-6-0x00000000052D0000-0x00000000052D1000-memory.dmp

Download

memory/988-14-0x00000000099F0000-0x00000000099FB000-memory.dmp

Download

memory/988-15-0x000000000CA20000-0x000000000CA21000-memory.dmp

Download

memory/988-5-0x00000000056F0000-0x00000000056F1000-memory.dmp

Download

memory/988-3-0x0000000000900000-0x0000000000901000-memory.dmp

Download

memory/2984-19-0x0000000000500000-0x0000000000592000-memory.dmp

Download

memory/3156-20-0x00000000048C0000-0x00000000048C1000-memory.dmp

Download