raccoon | 07c5bda6acaa4ec2e66b67272abcc4c4be4f38e977d7a80fedb7fe2e3cefb705

Analysis

max time kernel
20s
max time network
135s
platform
windows10_x64
resource
win10v20210408
submitted
31/08/2021, 06:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
379764588a0aa597e2357f503a3a72fd.exe
Size 514KB
Sample210831-hvy8ct9ran
SHA256 07c5bda6acaa4ec2e66b67272abcc4c4be4f38e977d7a80fedb7fe2e3cefb705
MD5 379764588a0aa597e2357f503a3a72fd
SHA1 078e98b048fd9719556c2e9901a55497d01777c1
SHA512 682d29070fcd99cd343e6389ae3dcbcf23468dc922093c3e22a0b6145a6ff091657f42c0497189f73687f6ca28890a9af51ef5db9561abd6e16522887877baff
MD5 SHA1 SHA512

Score

10^/10

raccoon 6e76410dbdf2085ebcf2777560bd8cb0790329c9 spyware stealer

Malware Config

Extracted

Family

raccoon

Botnet

6e76410dbdf2085ebcf2777560bd8cb0790329c9

Attributes

url4cnc
https://telete.in/bibiOutriggr1

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4052 created 640	4052	WerFault.exe	66

Loads dropped DLL 1 IoCs

pid	Process
640	379764588a0aa597e2357f503a3a72fd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Program crash 14 IoCs

pid	pid_target	Process	procid_target
420	640	WerFault.exe	66
3932	640	WerFault.exe	66
208	640	WerFault.exe	66
2224	640	WerFault.exe	66
2476	640	WerFault.exe	66
3128	640	WerFault.exe	66
1312	640	WerFault.exe	66
2156	640	WerFault.exe	66
2168	640	WerFault.exe	66
1544	640	WerFault.exe	66
3980	640	WerFault.exe	66
3888	640	WerFault.exe	66
2000	640	WerFault.exe	66
4052	640	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
3932	WerFault.exe
3932	WerFault.exe
3932	WerFault.exe
3932	WerFault.exe
3932	WerFault.exe
3932	WerFault.exe
3932	WerFault.exe
3932	WerFault.exe
3932	WerFault.exe
3932	WerFault.exe
3932	WerFault.exe
3932	WerFault.exe
3932	WerFault.exe
3932	WerFault.exe
208	WerFault.exe
208	WerFault.exe
208	WerFault.exe
208	WerFault.exe
208	WerFault.exe
208	WerFault.exe
208	WerFault.exe
208	WerFault.exe
208	WerFault.exe
208	WerFault.exe
208	WerFault.exe
208	WerFault.exe
208	WerFault.exe
208	WerFault.exe
2224	WerFault.exe
2224	WerFault.exe
2224	WerFault.exe
2224	WerFault.exe
2224	WerFault.exe
2224	WerFault.exe
2224	WerFault.exe
2224	WerFault.exe
2224	WerFault.exe
2224	WerFault.exe
2224	WerFault.exe
2224	WerFault.exe
2224	WerFault.exe
2224	WerFault.exe
2476	WerFault.exe
2476	WerFault.exe
2476	WerFault.exe
2476	WerFault.exe
2476	WerFault.exe
2476	WerFault.exe
2476	WerFault.exe
2476	WerFault.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeRestorePrivilege	420	WerFault.exe
Token: SeBackupPrivilege	420	WerFault.exe
Token: SeDebugPrivilege	420	WerFault.exe
Token: SeDebugPrivilege	3932	WerFault.exe
Token: SeDebugPrivilege	208	WerFault.exe
Token: SeDebugPrivilege	2224	WerFault.exe
Token: SeDebugPrivilege	2476	WerFault.exe
Token: SeDebugPrivilege	3128	WerFault.exe
Token: SeDebugPrivilege	1312	WerFault.exe
Token: SeDebugPrivilege	2156	WerFault.exe
Token: SeDebugPrivilege	2168	WerFault.exe
Token: SeDebugPrivilege	1544	WerFault.exe
Token: SeDebugPrivilege	3980	WerFault.exe
Token: SeDebugPrivilege	3888	WerFault.exe
Token: SeDebugPrivilege	2000	WerFault.exe
Token: SeDebugPrivilege	4052	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\379764588a0aa597e2357f503a3a72fd.exe
"C:\Users\Admin\AppData\Local\Temp\379764588a0aa597e2357f503a3a72fd.exe"
1⤵
- Loads dropped DLL
PID:640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 740
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 848
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 828
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 888
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 1196
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 1056
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 1252
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 1288
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 1044
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 1220
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 1236
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 1212
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 1248
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 1224
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:4052

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/640-114-0x0000000003B50000-0x0000000003BDF000-memory.dmp

Download

memory/640-115-0x0000000000400000-0x0000000001DCD000-memory.dmp

Download