raccoon | 20ffbc52ca4b39d8b0ca4caa73a02094f3e51f6d8098b31ccb1a8b6eed8ba57f

Analysis

max time kernel
23s
max time network
151s
platform
windows10_x64
resource
win10v20210408
submitted
30/08/2021, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bcad6ac6070e8d1be2571778e7c54a70.exe
Size 493KB
Sample210830-lfbvcnw316
SHA256 20ffbc52ca4b39d8b0ca4caa73a02094f3e51f6d8098b31ccb1a8b6eed8ba57f
MD5 bcad6ac6070e8d1be2571778e7c54a70
SHA1 04035629424e2991009357054203c2a7a7e45c98
SHA512 a685d494eda3335e8e95f7fcd44c56eee1a625db49c945af0a4c527550e2578012ee60f4a64ca2fb984af2aeaad768b1bffe56f52e2e68b41342c7c409d8ddb1
MD5 SHA1 SHA512

Score

10^/10

raccoon 6e76410dbdf2085ebcf2777560bd8cb0790329c9 spyware stealer

Malware Config

Extracted

Family

raccoon

Botnet

6e76410dbdf2085ebcf2777560bd8cb0790329c9

Attributes

url4cnc
https://telete.in/bibiOutriggr1

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3920 created 416	3920	WerFault.exe	67

Loads dropped DLL 1 IoCs

pid	Process
416	bcad6ac6070e8d1be2571778e7c54a70.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Program crash 14 IoCs

pid	pid_target	Process	procid_target
780	416	WerFault.exe	67
948	416	WerFault.exe	67
3636	416	WerFault.exe	67
2312	416	WerFault.exe	67
3172	416	WerFault.exe	67
2308	416	WerFault.exe	67
2100	416	WerFault.exe	67
1240	416	WerFault.exe	67
3948	416	WerFault.exe	67
4040	416	WerFault.exe	67
3424	416	WerFault.exe	67
4076	416	WerFault.exe	67
3196	416	WerFault.exe	67
3920	416	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
780	WerFault.exe
780	WerFault.exe
780	WerFault.exe
780	WerFault.exe
780	WerFault.exe
780	WerFault.exe
780	WerFault.exe
780	WerFault.exe
780	WerFault.exe
780	WerFault.exe
780	WerFault.exe
780	WerFault.exe
780	WerFault.exe
780	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
2312	WerFault.exe
2312	WerFault.exe
2312	WerFault.exe
2312	WerFault.exe
2312	WerFault.exe
2312	WerFault.exe
2312	WerFault.exe
2312	WerFault.exe
2312	WerFault.exe
2312	WerFault.exe
2312	WerFault.exe
2312	WerFault.exe
2312	WerFault.exe
2312	WerFault.exe
3172	WerFault.exe
3172	WerFault.exe
3172	WerFault.exe
3172	WerFault.exe
3172	WerFault.exe
3172	WerFault.exe
3172	WerFault.exe
3172	WerFault.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeRestorePrivilege	780	WerFault.exe
Token: SeBackupPrivilege	780	WerFault.exe
Token: SeDebugPrivilege	780	WerFault.exe
Token: SeDebugPrivilege	948	WerFault.exe
Token: SeDebugPrivilege	3636	WerFault.exe
Token: SeDebugPrivilege	2312	WerFault.exe
Token: SeDebugPrivilege	3172	WerFault.exe
Token: SeDebugPrivilege	2308	WerFault.exe
Token: SeDebugPrivilege	2100	WerFault.exe
Token: SeDebugPrivilege	1240	WerFault.exe
Token: SeDebugPrivilege	3948	WerFault.exe
Token: SeDebugPrivilege	4040	WerFault.exe
Token: SeDebugPrivilege	3424	WerFault.exe
Token: SeDebugPrivilege	4076	WerFault.exe
Token: SeDebugPrivilege	3196	WerFault.exe
Token: SeDebugPrivilege	3920	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bcad6ac6070e8d1be2571778e7c54a70.exe
"C:\Users\Admin\AppData\Local\Temp\bcad6ac6070e8d1be2571778e7c54a70.exe"
1⤵
- Loads dropped DLL
PID:416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 740
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 820
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 776
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 916
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 1188
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 1260
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 1236
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 1360
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 1228
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 1144
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:4040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 1276
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 1188
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:4076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 1244
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 1384
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/416-114-0x0000000003B00000-0x0000000003B8F000-memory.dmp

Download

memory/416-115-0x0000000000400000-0x0000000001DC8000-memory.dmp

Download