raccoon | 22229ae10d0454005bd584838fc73c39027751e8953727d77cba63191ff9b3ce | Triage

Analysis

max time kernel
89s
max time network
151s
platform
windows10_x64
resource
win10v20210410
submitted
16-06-2021 22:14

Sharing

Report Analysis Logs

General

Target

eufive_20210616-233809.exe
Size

572KB
MD5

aff24adcac0d43fdedf7f1fca5010d43
SHA1

9b085a92dd390a87969054750fc4df0f3ab3ca23
SHA256

22229ae10d0454005bd584838fc73c39027751e8953727d77cba63191ff9b3ce
SHA512

4ae5763f41e9d86b04bc1cde044afaa39a44e911bad7b07df0e252445bd602026192856014a98662ce92788620689511169c03c9bd011c02d61f025631edc2a0

Score

10^/10

raccoon 3d7990f080e9dcb56104447e3789dec4380efc8b stealer

Malware Config

Extracted

Family

raccoon

Botnet

3d7990f080e9dcb56104447e3789dec4380efc8b

Attributes

url4cnc
https://telete.in/jvadikkamushkin

rc4.plain

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 2816 created 3256 2816 WerFault.exe eufive_20210616-233809.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2816 3256 WerFault.exe eufive_20210616-233809.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2816	WerFault.exe
2816	WerFault.exe
2816	WerFault.exe
2816	WerFault.exe
2816	WerFault.exe
2816	WerFault.exe
2816	WerFault.exe
2816	WerFault.exe
2816	WerFault.exe
2816	WerFault.exe
2816	WerFault.exe
2816	WerFault.exe
2816	WerFault.exe
2816	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2816 WerFault.exe
Token: SeBackupPrivilege 2816 WerFault.exe
Token: SeDebugPrivilege 2816 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\eufive_20210616-233809.exe
"C:\Users\Admin\AppData\Local\Temp\eufive_20210616-233809.exe"
1⤵
PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 1160
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3256-114-0x0000000000BB0000-0x0000000000C41000-memory.dmp

Filesize
580KB

Download
memory/3256-115-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download