Analysis
- max time kernel
86s - max time network
153s - platform
windows10_x64 - resource
win10v20210410 - submitted
11/08/2021, 19:11
General
- Target 41FA35AD45D4442404F2F970EE3578B8.exe
- Size 6.6MB
- Sample210811-hd45azdek6
- SHA256 56f1c287ea437e4642a04cfb0f44f2dcc74a0eeb3204aba76fd0c64f31b0dffd
Score
10/10
Malware Config
Extracted
Family
-
raccoon
Botnet
-
bb8d3701ca5d8e031967c87b862623b34997b3d1
Attributes
-
url4cnc
https://telete.in/jdiamond13
rc4.plain
rc4.plain
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- Raccoon Stealer Payload 2 IoCs
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\41FA35AD45D4442404F2F970EE3578B8.exe"C:\Users\Admin\AppData\Local\Temp\41FA35AD45D4442404F2F970EE3578B8.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 6562⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3984-115-0x0000000000400000-0x0000000000E7B000-memory.dmp
memory/3984-114-0x0000000002C70000-0x0000000002D01000-memory.dmp