raccoon | 5b5534877ef572fd9c6ae870ab966c102fee3a010c89cbb8baecc249fc03e508 | Triage

Analysis

max time kernel
133s
max time network
134s
platform
windows10_x64
resource
win10v20210410
submitted
15-04-2021 15:05

Sharing

Report Analysis Logs

General

Target

46c1325f35cd5958dea23230043a5e84.exe
Size

526KB
MD5

46c1325f35cd5958dea23230043a5e84
SHA1

796e8b3e485625d1e052696c651ad6dd93e911cd
SHA256

5b5534877ef572fd9c6ae870ab966c102fee3a010c89cbb8baecc249fc03e508
SHA512

76f32cd141d2bb8dd514f9939e8083ad7bf19889606898c1cf6260a5322768f502061185c8b236f6560ee2dbf5465f65f8075e655403d1abf66e1b2cdc15b52a

Score

10^/10

raccoon f6a4646c17af7db77b0a5aba1906d97ffcdd34ed stealer

Malware Config

Extracted

Family

raccoon

Botnet

f6a4646c17af7db77b0a5aba1906d97ffcdd34ed

Attributes

url4cnc
https://telete.in/jdiamond13

rc4.plain

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3772 created 1892 3772 WerFault.exe 46c1325f35cd5958dea23230043a5e84.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3772 1892 WerFault.exe 46c1325f35cd5958dea23230043a5e84.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3772	WerFault.exe
3772	WerFault.exe
3772	WerFault.exe
3772	WerFault.exe
3772	WerFault.exe
3772	WerFault.exe
3772	WerFault.exe
3772	WerFault.exe
3772	WerFault.exe
3772	WerFault.exe
3772	WerFault.exe
3772	WerFault.exe
3772	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3772 WerFault.exe
Token: SeBackupPrivilege 3772 WerFault.exe
Token: SeDebugPrivilege 3772 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\46c1325f35cd5958dea23230043a5e84.exe
"C:\Users\Admin\AppData\Local\Temp\46c1325f35cd5958dea23230043a5e84.exe"
1⤵
PID:1892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 608
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1892-114-0x0000000002500000-0x0000000002591000-memory.dmp

Filesize
580KB

Download
memory/1892-115-0x0000000000400000-0x000000000087C000-memory.dmp

Filesize
4.5MB

Download