raccoon | 8499d2cf32acff33664bb3b960543c298f69266269c08c871b5ee6a222b447bd

Analysis

max time kernel
38s
max time network
116s
platform
windows10_x64
resource
win10v20210410
submitted
23/08/2021, 20:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4411CEF6146921CDB7FAFA72E7EB2973.exe
Size 430KB
Sample210823-ebyeprkn3x
SHA256 8499d2cf32acff33664bb3b960543c298f69266269c08c871b5ee6a222b447bd
MD5 4411cef6146921cdb7fafa72e7eb2973
SHA1 f333487944a3031d8888065e8dae1ff4101322ef
SHA512 d95d799858b7c549f24dc7e4199d8e755d144650eacb6189bf59f6cf7da151223a179b6db4c1211f04a15e35c35b95a9170dba3b8f9254f7766d5249e9e837a2
MD5 SHA1 SHA512

Score

10^/10

raccoon 5a8c8e1fce3de1a11c8994956b894179a58fb006 spyware stealer

Malware Config

Extracted

Family

raccoon

Botnet

5a8c8e1fce3de1a11c8994956b894179a58fb006

Attributes

url4cnc
https://telete.in/fsdhelloagain

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1100 created 740	1100	WerFault.exe	68

Loads dropped DLL 1 IoCs

pid	Process
740	4411CEF6146921CDB7FAFA72E7EB2973.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Program crash 14 IoCs

pid	pid_target	Process	procid_target
768	740	WerFault.exe	68
4060	740	WerFault.exe	68
3784	740	WerFault.exe	68
1256	740	WerFault.exe	68
2144	740	WerFault.exe	68
2636	740	WerFault.exe	68
3204	740	WerFault.exe	68
2696	740	WerFault.exe	68
3108	740	WerFault.exe	68
3660	740	WerFault.exe	68
2284	740	WerFault.exe	68
3576	740	WerFault.exe	68
3692	740	WerFault.exe	68
1100	740	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
1256	WerFault.exe
1256	WerFault.exe
1256	WerFault.exe
1256	WerFault.exe
1256	WerFault.exe
1256	WerFault.exe
1256	WerFault.exe
1256	WerFault.exe
1256	WerFault.exe
1256	WerFault.exe
1256	WerFault.exe
1256	WerFault.exe
1256	WerFault.exe
1256	WerFault.exe
1256	WerFault.exe
2144	WerFault.exe
2144	WerFault.exe
2144	WerFault.exe
2144	WerFault.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeRestorePrivilege	768	WerFault.exe
Token: SeBackupPrivilege	768	WerFault.exe
Token: SeDebugPrivilege	768	WerFault.exe
Token: SeDebugPrivilege	4060	WerFault.exe
Token: SeDebugPrivilege	3784	WerFault.exe
Token: SeDebugPrivilege	1256	WerFault.exe
Token: SeDebugPrivilege	2144	WerFault.exe
Token: SeDebugPrivilege	2636	WerFault.exe
Token: SeDebugPrivilege	3204	WerFault.exe
Token: SeDebugPrivilege	2696	WerFault.exe
Token: SeDebugPrivilege	3108	WerFault.exe
Token: SeDebugPrivilege	3660	WerFault.exe
Token: SeDebugPrivilege	2284	WerFault.exe
Token: SeDebugPrivilege	3576	WerFault.exe
Token: SeDebugPrivilege	3692	WerFault.exe
Token: SeDebugPrivilege	1100	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4411CEF6146921CDB7FAFA72E7EB2973.exe
"C:\Users\Admin\AppData\Local\Temp\4411CEF6146921CDB7FAFA72E7EB2973.exe"
1⤵
- Loads dropped DLL
PID:740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 732
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 736
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 748
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 880
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 1184
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 1240
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 1300
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 1332
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 1220
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 1320
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 1208
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 1228
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 1332
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 1248
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/740-115-0x0000000000400000-0x0000000002CFA000-memory.dmp

Download

memory/740-114-0x0000000004950000-0x00000000049DF000-memory.dmp

Download