raccoon | 6cf7b8a22a4350220cc796f28cf8ad0c7b63e62c8d3c93e5772e726ca23496ee

Analysis

max time kernel
130s
max time network
139s
platform
windows10_x64
resource
win10v20201028
submitted
19/03/2021, 15:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a6faaf165a712f58eec277d4e8599a0a.exe
Size 1.1MB
Sample210319-xsfntaahjj
SHA256 6cf7b8a22a4350220cc796f28cf8ad0c7b63e62c8d3c93e5772e726ca23496ee
MD5 a6faaf165a712f58eec277d4e8599a0a
SHA1 c4b643424ea385e2fedad88fa0e52459b2964e31
SHA512 74e9e7737b3b43d14d4665cfc7f5796a3c7644d1b303b432d1bee1430e327d4f6c880b3cf955259d2f1154ef2900324039a6b51724d937b4dd760ede89f4b084
MD5 SHA1 SHA512

Score

10^/10

raccoon f4a08085af522bf03961382990b83cfa0ed85c85 stealer

Malware Config

Extracted

Family

raccoon

Botnet

f4a08085af522bf03961382990b83cfa0ed85c85

Attributes

url4cnc
https://telete.in/j90dadarobin

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1192 set thread context of 1456	1192	a6faaf165a712f58eec277d4e8599a0a.exe	79

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1192	a6faaf165a712f58eec277d4e8599a0a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1192	a6faaf165a712f58eec277d4e8599a0a.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 1456	1192	a6faaf165a712f58eec277d4e8599a0a.exe	79
PID 1192 wrote to memory of 1456	1192	a6faaf165a712f58eec277d4e8599a0a.exe	79
PID 1192 wrote to memory of 1456	1192	a6faaf165a712f58eec277d4e8599a0a.exe	79
PID 1192 wrote to memory of 1456	1192	a6faaf165a712f58eec277d4e8599a0a.exe	79
PID 1192 wrote to memory of 1456	1192	a6faaf165a712f58eec277d4e8599a0a.exe	79
PID 1192 wrote to memory of 1456	1192	a6faaf165a712f58eec277d4e8599a0a.exe	79
PID 1192 wrote to memory of 1456	1192	a6faaf165a712f58eec277d4e8599a0a.exe	79
PID 1192 wrote to memory of 1456	1192	a6faaf165a712f58eec277d4e8599a0a.exe	79
PID 1192 wrote to memory of 1456	1192	a6faaf165a712f58eec277d4e8599a0a.exe	79

C:\Users\Admin\AppData\Local\Temp\a6faaf165a712f58eec277d4e8599a0a.exe
"C:\Users\Admin\AppData\Local\Temp\a6faaf165a712f58eec277d4e8599a0a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Users\Admin\AppData\Local\Temp\a6faaf165a712f58eec277d4e8599a0a.exe
  "C:\Users\Admin\AppData\Local\Temp\a6faaf165a712f58eec277d4e8599a0a.exe"
  2⤵
  PID:1456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1192-2-0x0000000073A80000-0x000000007416E000-memory.dmp

Download

memory/1192-3-0x0000000000310000-0x0000000000311000-memory.dmp

Download

memory/1192-5-0x0000000004D10000-0x0000000004D11000-memory.dmp

Download

memory/1192-6-0x00000000052B0000-0x00000000052B1000-memory.dmp

Download

memory/1192-7-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Download

memory/1192-8-0x00000000027F0000-0x00000000027F1000-memory.dmp

Download

memory/1192-9-0x0000000004F70000-0x0000000004F71000-memory.dmp

Download

memory/1192-10-0x0000000005030000-0x0000000005031000-memory.dmp

Download

memory/1192-11-0x0000000004C60000-0x0000000004C6B000-memory.dmp

Download

memory/1192-12-0x0000000005BD0000-0x0000000005CBB000-memory.dmp

Download

memory/1456-13-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/1456-15-0x0000000000400000-0x0000000000492000-memory.dmp

Download