raccoon | 458336e4ae2be58debd691111adf03f41ca863bd1a828daab4622a524a241e86

Analysis

max time kernel
26s
max time network
131s
platform
windows10_x64
resource
win10v20210408
submitted
29/08/2021, 07:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4761fb6bddda54259ad0712055ba2814.exe
Size 422KB
Sample210829-afbjrt5hk6
SHA256 458336e4ae2be58debd691111adf03f41ca863bd1a828daab4622a524a241e86
MD5 4761fb6bddda54259ad0712055ba2814
SHA1 20a33a1da4fae2baea8a00e43084e9ca20a3d06b
SHA512 bd98649d19816a194ea77926323ae46ed5487fac7ca3c3f4c89262f03384b0ad946bfde2e577c151f35e245221c54c373f702cdbe208a09d6423eac81faed376
MD5 SHA1 SHA512

Score

10^/10

raccoon 6e76410dbdf2085ebcf2777560bd8cb0790329c9 spyware stealer

Malware Config

Extracted

Family

raccoon

Botnet

6e76410dbdf2085ebcf2777560bd8cb0790329c9

Attributes

url4cnc
https://telete.in/bibiOutriggr1

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4068 created 992	4068	WerFault.exe	67

Loads dropped DLL 1 IoCs

pid	Process
992	4761fb6bddda54259ad0712055ba2814.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Program crash 14 IoCs

pid	pid_target	Process	procid_target
212	992	WerFault.exe	67
2160	992	WerFault.exe	67
3544	992	WerFault.exe	67
504	992	WerFault.exe	67
1252	992	WerFault.exe	67
2040	992	WerFault.exe	67
416	992	WerFault.exe	67
2344	992	WerFault.exe	67
3572	992	WerFault.exe	67
3832	992	WerFault.exe	67
2304	992	WerFault.exe	67
4076	992	WerFault.exe	67
3188	992	WerFault.exe	67
4068	992	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe
3544	WerFault.exe
3544	WerFault.exe
3544	WerFault.exe
3544	WerFault.exe
3544	WerFault.exe
3544	WerFault.exe
3544	WerFault.exe
3544	WerFault.exe
3544	WerFault.exe
3544	WerFault.exe
3544	WerFault.exe
3544	WerFault.exe
3544	WerFault.exe
3544	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
1252	WerFault.exe
1252	WerFault.exe
1252	WerFault.exe
1252	WerFault.exe
1252	WerFault.exe
1252	WerFault.exe
1252	WerFault.exe
1252	WerFault.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeRestorePrivilege	212	WerFault.exe
Token: SeBackupPrivilege	212	WerFault.exe
Token: SeDebugPrivilege	212	WerFault.exe
Token: SeDebugPrivilege	2160	WerFault.exe
Token: SeDebugPrivilege	3544	WerFault.exe
Token: SeDebugPrivilege	504	WerFault.exe
Token: SeDebugPrivilege	1252	WerFault.exe
Token: SeDebugPrivilege	2040	WerFault.exe
Token: SeDebugPrivilege	2344	WerFault.exe
Token: SeDebugPrivilege	3572	WerFault.exe
Token: SeDebugPrivilege	3832	WerFault.exe
Token: SeDebugPrivilege	2304	WerFault.exe
Token: SeDebugPrivilege	4076	WerFault.exe
Token: SeDebugPrivilege	3188	WerFault.exe
Token: SeDebugPrivilege	4068	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4761fb6bddda54259ad0712055ba2814.exe
"C:\Users\Admin\AppData\Local\Temp\4761fb6bddda54259ad0712055ba2814.exe"
1⤵
- Loads dropped DLL
PID:992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 732
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 844
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 832
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 896
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1184
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1196
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1144
  2⤵
  - Program crash
  PID:416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1220
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1224
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 792
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1272
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1244
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:4076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 804
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1280
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:4068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/992-114-0x00000000039D0000-0x0000000003A5F000-memory.dmp

Download

memory/992-115-0x0000000000400000-0x0000000001DB7000-memory.dmp

Download