raccoon | a7062fb3a21fa88712e225861e57c12bb081bf13526e61f083f84ebeeecbc77f

Analysis

max time kernel
21s
max time network
121s
platform
windows10_x64
resource
win10v20210408
submitted
01/09/2021, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b7a2af11ab5c2c997b5d9b2278da3076.exe
Size 573KB
Sample210901-hwe3jy39be
SHA256 a7062fb3a21fa88712e225861e57c12bb081bf13526e61f083f84ebeeecbc77f
MD5 b7a2af11ab5c2c997b5d9b2278da3076
SHA1 a0add7a6eaf1661699627c2c4f52e900e59fcd67
SHA512 c5f2e758bdeed78a52fe26dcba824ab848cd12c832c69f4a14fa9e2c37fcb91cf8e39cee33fe54cff9c666ccb1768ce819bdf6b6d77b5438fe596784ababe6b1
MD5 SHA1 SHA512

Score

10^/10

raccoon 6e76410dbdf2085ebcf2777560bd8cb0790329c9 spyware stealer

Malware Config

Extracted

Family

raccoon

Botnet

6e76410dbdf2085ebcf2777560bd8cb0790329c9

Attributes

url4cnc
https://telete.in/bibiOutriggr1

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3260 created 804	3260	WerFault.exe	67

Loads dropped DLL 1 IoCs

pid	Process
804	b7a2af11ab5c2c997b5d9b2278da3076.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Program crash 14 IoCs

pid	pid_target	Process	procid_target
212	804	WerFault.exe	67
2776	804	WerFault.exe	67
3020	804	WerFault.exe	67
1560	804	WerFault.exe	67
2192	804	WerFault.exe	67
996	804	WerFault.exe	67
2288	804	WerFault.exe	67
2340	804	WerFault.exe	67
3856	804	WerFault.exe	67
3376	804	WerFault.exe	67
1680	804	WerFault.exe	67
4064	804	WerFault.exe	67
3340	804	WerFault.exe	67
3260	804	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
212	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
3020	WerFault.exe
3020	WerFault.exe
3020	WerFault.exe
3020	WerFault.exe
3020	WerFault.exe
3020	WerFault.exe
3020	WerFault.exe
3020	WerFault.exe
3020	WerFault.exe
3020	WerFault.exe
3020	WerFault.exe
3020	WerFault.exe
3020	WerFault.exe
3020	WerFault.exe
1560	WerFault.exe
1560	WerFault.exe
1560	WerFault.exe
1560	WerFault.exe
1560	WerFault.exe
1560	WerFault.exe
1560	WerFault.exe
1560	WerFault.exe
1560	WerFault.exe
1560	WerFault.exe
1560	WerFault.exe
1560	WerFault.exe
1560	WerFault.exe
1560	WerFault.exe
2192	WerFault.exe
2192	WerFault.exe
2192	WerFault.exe
2192	WerFault.exe
2192	WerFault.exe
2192	WerFault.exe
2192	WerFault.exe
2192	WerFault.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeRestorePrivilege	212	WerFault.exe
Token: SeBackupPrivilege	212	WerFault.exe
Token: SeDebugPrivilege	212	WerFault.exe
Token: SeDebugPrivilege	2776	WerFault.exe
Token: SeDebugPrivilege	3020	WerFault.exe
Token: SeDebugPrivilege	1560	WerFault.exe
Token: SeDebugPrivilege	2192	WerFault.exe
Token: SeDebugPrivilege	996	WerFault.exe
Token: SeDebugPrivilege	2340	WerFault.exe
Token: SeDebugPrivilege	3856	WerFault.exe
Token: SeDebugPrivilege	3376	WerFault.exe
Token: SeDebugPrivilege	1680	WerFault.exe
Token: SeDebugPrivilege	4064	WerFault.exe
Token: SeDebugPrivilege	3340	WerFault.exe
Token: SeDebugPrivilege	3260	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\b7a2af11ab5c2c997b5d9b2278da3076.exe
"C:\Users\Admin\AppData\Local\Temp\b7a2af11ab5c2c997b5d9b2278da3076.exe"
1⤵
- Loads dropped DLL
PID:804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 744
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 816
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 864
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 912
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 1184
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 1252
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 1140
  2⤵
  - Program crash
  PID:2288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 1292
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 1192
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 1316
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 1224
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 1164
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:4064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 1312
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 128
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3260

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/804-114-0x00000000023E0000-0x000000000246F000-memory.dmp

Download

memory/804-115-0x0000000000400000-0x00000000021AE000-memory.dmp

Download