raccoon | 23e90f7107a6965ebfaf5fcf719feb3fff0b41747a8fd46713ac7cbef4535dc9

Analysis

max time kernel
24s
max time network
117s
platform
windows10_x64
resource
win10v20210408
submitted
03/09/2021, 12:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
17154ce0df2477a9caa57a2fc9ade12f.exe
Size 502KB
Sample210903-pjznvsdac7
SHA256 23e90f7107a6965ebfaf5fcf719feb3fff0b41747a8fd46713ac7cbef4535dc9
MD5 17154ce0df2477a9caa57a2fc9ade12f
SHA1 1c5d885911a82eef7bca53dd4f2b90b6af410c01
SHA512 7b1528c01718dfa13c1448c67397c6bed745846ce170cb5f1f7f452941bc9fe117519b9cd4e0608ff444d0172bd34ae50bc16edd332dc96e448018db36f0b09e
MD5 SHA1 SHA512

Score

10^/10

raccoon fe582536ec580228180f270f7cb80a867860e010 spyware stealer

Malware Config

Extracted

Family

raccoon

Botnet

fe582536ec580228180f270f7cb80a867860e010

Attributes

url4cnc
https://telete.in/xylichanjk

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3972 created 664	3972	WerFault.exe	67

Loads dropped DLL 1 IoCs

pid	Process
664	17154ce0df2477a9caa57a2fc9ade12f.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Program crash 14 IoCs

pid	pid_target	Process	procid_target
3268	664	WerFault.exe	67
928	664	WerFault.exe	67
2712	664	WerFault.exe	67
1328	664	WerFault.exe	67
3768	664	WerFault.exe	67
1460	664	WerFault.exe	67
2140	664	WerFault.exe	67
3944	664	WerFault.exe	67
2236	664	WerFault.exe	67
3152	664	WerFault.exe	67
4048	664	WerFault.exe	67
3168	664	WerFault.exe	67
1788	664	WerFault.exe	67
3972	664	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
928	WerFault.exe
928	WerFault.exe
928	WerFault.exe
928	WerFault.exe
928	WerFault.exe
928	WerFault.exe
928	WerFault.exe
928	WerFault.exe
928	WerFault.exe
928	WerFault.exe
928	WerFault.exe
928	WerFault.exe
928	WerFault.exe
928	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
3768	WerFault.exe
3768	WerFault.exe
3768	WerFault.exe
3768	WerFault.exe
3768	WerFault.exe
3768	WerFault.exe
3768	WerFault.exe
3768	WerFault.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeRestorePrivilege	3268	WerFault.exe
Token: SeBackupPrivilege	3268	WerFault.exe
Token: SeDebugPrivilege	3268	WerFault.exe
Token: SeDebugPrivilege	928	WerFault.exe
Token: SeDebugPrivilege	2712	WerFault.exe
Token: SeDebugPrivilege	1328	WerFault.exe
Token: SeDebugPrivilege	3768	WerFault.exe
Token: SeDebugPrivilege	1460	WerFault.exe
Token: SeDebugPrivilege	2140	WerFault.exe
Token: SeDebugPrivilege	3944	WerFault.exe
Token: SeDebugPrivilege	2236	WerFault.exe
Token: SeDebugPrivilege	3152	WerFault.exe
Token: SeDebugPrivilege	4048	WerFault.exe
Token: SeDebugPrivilege	3168	WerFault.exe
Token: SeDebugPrivilege	1788	WerFault.exe
Token: SeDebugPrivilege	3972	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\17154ce0df2477a9caa57a2fc9ade12f.exe
"C:\Users\Admin\AppData\Local\Temp\17154ce0df2477a9caa57a2fc9ade12f.exe"
1⤵
- Loads dropped DLL
PID:664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 736
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 820
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 860
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 840
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 1180
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 1240
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 832
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 1156
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 704
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 1152
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 1276
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:4048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 1316
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 1228
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 1208
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/664-114-0x0000000003ED0000-0x0000000003F5F000-memory.dmp

Download

memory/664-115-0x0000000000400000-0x000000000219B000-memory.dmp

Download