raccoon | b185909f484fb9247ee23e1ca9bc8a9914db5a8b41caa4a164b7328ed9a3153a

Analysis

max time kernel
99s
max time network
152s
platform
windows10_x64
resource
win10v20210408
submitted
30/08/2021, 03:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b185909f484fb9247ee23e1ca9bc8a9914db5a8b41caa.exe
Size 341KB
Sample210830-ejax1we21e
SHA256 b185909f484fb9247ee23e1ca9bc8a9914db5a8b41caa4a164b7328ed9a3153a
MD5 beeeb87dd7ec241210dcd79927301f3a
SHA1 8c314b76ce6197aee7e8fe90b41bdb511f2d43d6
SHA512 fae9931d36eaba78fe33509a83ad1558b37e77b2c87ffc95c5e06b7e90305767d05d71df317b4676b89991a123132d57f3e6e337186410f568450e415048e84a
MD5 SHA1 SHA512

Score

10^/10

raccoon vidar 6e76410dbdf2085ebcf2777560bd8cb0790329c9 spyware stealer

Malware Config

Extracted

Family

raccoon

Botnet

6e76410dbdf2085ebcf2777560bd8cb0790329c9

Attributes

url4cnc
https://telete.in/bibiOutriggr1

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 3820 created 3844	3820	WerFault.exe	89
PID 1520 created 2852	1520	WerFault.exe	109

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral2/memory/2852-130-0x0000000000400000-0x0000000001DF4000-memory.dmp	family_vidar
behavioral2/memory/2852-129-0x0000000003A60000-0x0000000003B33000-memory.dmp	family_vidar

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
3844	0477729779.exe
2852	2072741025.exe

Loads dropped DLL 3 IoCs

pid	Process
3844	0477729779.exe
2852	2072741025.exe
2852	2072741025.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	freegeoip.app
22	freegeoip.app
23	freegeoip.app
25	freegeoip.app

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 39 IoCs

pid	pid_target	Process	procid_target
4028	4060	WerFault.exe	67
3064	4060	WerFault.exe	67
2268	4060	WerFault.exe	67
3008	4060	WerFault.exe	67
1308	4060	WerFault.exe	67
4076	4060	WerFault.exe	67
1540	4060	WerFault.exe	67
2108	4060	WerFault.exe	67
1296	4060	WerFault.exe	67
3748	3844	WerFault.exe	89
1872	3844	WerFault.exe	89
3752	3844	WerFault.exe	89
4028	3844	WerFault.exe	89
2296	3844	WerFault.exe	89
3540	3844	WerFault.exe	89
1300	3844	WerFault.exe	89
3976	3844	WerFault.exe	89
1164	3844	WerFault.exe	89
3224	3844	WerFault.exe	89
3956	3844	WerFault.exe	89
3628	3844	WerFault.exe	89
2068	3844	WerFault.exe	89
3820	3844	WerFault.exe	89
192	2852	WerFault.exe	109
2624	2852	WerFault.exe	109
3032	2852	WerFault.exe	109
3728	2852	WerFault.exe	109
3260	2852	WerFault.exe	109
2224	2852	WerFault.exe	109
932	2852	WerFault.exe	109
2696	2852	WerFault.exe	109
4060	2852	WerFault.exe	109
3088	2852	WerFault.exe	109
2080	2852	WerFault.exe	109
3816	2852	WerFault.exe	109
1628	2852	WerFault.exe	109
2788	2852	WerFault.exe	109
1312	2852	WerFault.exe	109
1520	2852	WerFault.exe	109

Kills process with taskkill 1 IoCs

evasion

pid	Process
1500	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
3064	WerFault.exe
3064	WerFault.exe
3064	WerFault.exe
3064	WerFault.exe
3064	WerFault.exe
3064	WerFault.exe
3064	WerFault.exe
3064	WerFault.exe
3064	WerFault.exe
3064	WerFault.exe
3064	WerFault.exe
3064	WerFault.exe
3064	WerFault.exe
3064	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
3008	WerFault.exe
3008	WerFault.exe
3008	WerFault.exe
3008	WerFault.exe
3008	WerFault.exe
3008	WerFault.exe
3008	WerFault.exe
3008	WerFault.exe
3008	WerFault.exe
3008	WerFault.exe
3008	WerFault.exe
3008	WerFault.exe
3008	WerFault.exe
3008	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeRestorePrivilege	4028	WerFault.exe
Token: SeBackupPrivilege	4028	WerFault.exe
Token: SeDebugPrivilege	4028	WerFault.exe
Token: SeDebugPrivilege	3064	WerFault.exe
Token: SeDebugPrivilege	2268	WerFault.exe
Token: SeDebugPrivilege	3008	WerFault.exe
Token: SeDebugPrivilege	1308	WerFault.exe
Token: SeDebugPrivilege	4076	WerFault.exe
Token: SeDebugPrivilege	1540	WerFault.exe
Token: SeDebugPrivilege	2108	WerFault.exe
Token: SeDebugPrivilege	1296	WerFault.exe
Token: SeDebugPrivilege	3748	WerFault.exe
Token: SeDebugPrivilege	1872	WerFault.exe
Token: SeDebugPrivilege	3752	WerFault.exe
Token: SeDebugPrivilege	4028	WerFault.exe
Token: SeDebugPrivilege	2296	WerFault.exe
Token: SeDebugPrivilege	3540	WerFault.exe
Token: SeDebugPrivilege	1300	WerFault.exe
Token: SeDebugPrivilege	3976	WerFault.exe
Token: SeDebugPrivilege	1164	WerFault.exe
Token: SeDebugPrivilege	3224	WerFault.exe
Token: SeDebugPrivilege	3956	WerFault.exe
Token: SeDebugPrivilege	3628	WerFault.exe
Token: SeDebugPrivilege	2068	WerFault.exe
Token: SeDebugPrivilege	3820	WerFault.exe
Token: SeDebugPrivilege	1500	taskkill.exe
Token: SeDebugPrivilege	192	WerFault.exe
Token: SeDebugPrivilege	2624	WerFault.exe
Token: SeDebugPrivilege	3032	WerFault.exe
Token: SeDebugPrivilege	3728	WerFault.exe
Token: SeDebugPrivilege	3260	WerFault.exe
Token: SeDebugPrivilege	2224	WerFault.exe
Token: SeDebugPrivilege	932	WerFault.exe
Token: SeDebugPrivilege	2696	WerFault.exe
Token: SeDebugPrivilege	4060	WerFault.exe
Token: SeDebugPrivilege	3088	WerFault.exe
Token: SeDebugPrivilege	2080	WerFault.exe
Token: SeDebugPrivilege	3816	WerFault.exe
Token: SeDebugPrivilege	1628	WerFault.exe
Token: SeDebugPrivilege	2788	WerFault.exe
Token: SeDebugPrivilege	1312	WerFault.exe
Token: SeDebugPrivilege	1520	WerFault.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 2068	4060	b185909f484fb9247ee23e1ca9bc8a9914db5a8b41caa.exe	87
PID 4060 wrote to memory of 2068	4060	b185909f484fb9247ee23e1ca9bc8a9914db5a8b41caa.exe	87
PID 4060 wrote to memory of 2068	4060	b185909f484fb9247ee23e1ca9bc8a9914db5a8b41caa.exe	87
PID 2068 wrote to memory of 3844	2068	cmd.exe	89
PID 2068 wrote to memory of 3844	2068	cmd.exe	89
PID 2068 wrote to memory of 3844	2068	cmd.exe	89
PID 4060 wrote to memory of 1396	4060	b185909f484fb9247ee23e1ca9bc8a9914db5a8b41caa.exe	105
PID 4060 wrote to memory of 1396	4060	b185909f484fb9247ee23e1ca9bc8a9914db5a8b41caa.exe	105
PID 4060 wrote to memory of 1396	4060	b185909f484fb9247ee23e1ca9bc8a9914db5a8b41caa.exe	105
PID 4060 wrote to memory of 2148	4060	b185909f484fb9247ee23e1ca9bc8a9914db5a8b41caa.exe	107
PID 4060 wrote to memory of 2148	4060	b185909f484fb9247ee23e1ca9bc8a9914db5a8b41caa.exe	107
PID 4060 wrote to memory of 2148	4060	b185909f484fb9247ee23e1ca9bc8a9914db5a8b41caa.exe	107
PID 1396 wrote to memory of 2852	1396	cmd.exe	109
PID 1396 wrote to memory of 2852	1396	cmd.exe	109
PID 1396 wrote to memory of 2852	1396	cmd.exe	109
PID 2148 wrote to memory of 1500	2148	cmd.exe	110
PID 2148 wrote to memory of 1500	2148	cmd.exe	110
PID 2148 wrote to memory of 1500	2148	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\b185909f484fb9247ee23e1ca9bc8a9914db5a8b41caa.exe
"C:\Users\Admin\AppData\Local\Temp\b185909f484fb9247ee23e1ca9bc8a9914db5a8b41caa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 772
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 760
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 852
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 888
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 976
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 1120
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:4076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 1160
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 1348
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2108
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\0477729779.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Users\Admin\AppData\Local\Temp\0477729779.exe
    "C:\Users\Admin\AppData\Local\Temp\0477729779.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3844
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 744
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:3748
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 856
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:1872
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 832
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:3752
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 896
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:4028
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 1196
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:2296
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 1244
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:3540
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 804
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:1300
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 652
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:3976
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 1284
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:1164
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 1352
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:3224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 1196
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:3956
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 680
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:3628
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 1244
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:2068
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 1160
      4⤵
      Suspicious use of NtCreateProcessExOtherParentProcess
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:3820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 1732
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1296
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\2072741025.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Users\Admin\AppData\Local\Temp\2072741025.exe
    "C:\Users\Admin\AppData\Local\Temp\2072741025.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2852
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 768
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:192
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 820
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:2624
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 800
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:3032
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 832
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:3728
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 964
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:3260
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 960
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:2224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 1116
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:932
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 1416
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:2696
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 1420
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:4060
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 1444
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:3088
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 1560
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:2080
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 1120
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:3816
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 1648
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:1628
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 1688
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:2788
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 1432
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:1312
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 1744
      4⤵
      Suspicious use of NtCreateProcessExOtherParentProcess
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:1520
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "b185909f484fb9247ee23e1ca9bc8a9914db5a8b41caa.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\b185909f484fb9247ee23e1ca9bc8a9914db5a8b41caa.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "b185909f484fb9247ee23e1ca9bc8a9914db5a8b41caa.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2852-130-0x0000000000400000-0x0000000001DF4000-memory.dmp

Download

memory/2852-129-0x0000000003A60000-0x0000000003B33000-memory.dmp

Download

memory/3844-121-0x0000000000400000-0x0000000001DC8000-memory.dmp

Download

memory/3844-120-0x00000000039E0000-0x0000000003A6F000-memory.dmp

Download

memory/4060-115-0x0000000000400000-0x0000000001DA2000-memory.dmp

Download

memory/4060-114-0x00000000039C0000-0x0000000003A0A000-memory.dmp

Download