raccoon | e4c826244f01a7c81d9fa83e0aed1e783714abd0556b663777bc5d8760f42c99

Analysis

max time kernel
40s
max time network
137s
platform
windows10_x64
resource
win10-en
submitted
04/09/2021, 05:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5C247288DC99B426FA311A55ED2B47DC.exe
Size 516KB
Sample210904-gdfd2adhd8
SHA256 e4c826244f01a7c81d9fa83e0aed1e783714abd0556b663777bc5d8760f42c99
MD5 5c247288dc99b426fa311a55ed2b47dc
SHA1 0dd1695ba344a199c79211cc0757e020974c30bc
SHA512 14cced762634a69849f06b9e87315b085945838b410ef0e05554f894c8b1229ad648ca1724b8b042ffbb772a9ab49f01340d1fc0858ae54c3db1e127f73f3266
MD5 SHA1 SHA512

Score

10^/10

raccoon fe582536ec580228180f270f7cb80a867860e010 spyware stealer

Malware Config

Extracted

Family

raccoon

Botnet

fe582536ec580228180f270f7cb80a867860e010

Attributes

url4cnc
https://telete.in/xylichanjk

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 584 created 3264	584	WerFault.exe	68

Loads dropped DLL 1 IoCs

pid	Process
3264	5C247288DC99B426FA311A55ED2B47DC.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Program crash 14 IoCs

pid	pid_target	Process	procid_target
1000	3264	WerFault.exe	68
2232	3264	WerFault.exe	68
3184	3264	WerFault.exe	68
3872	3264	WerFault.exe	68
2372	3264	WerFault.exe	68
3480	3264	WerFault.exe	68
2164	3264	WerFault.exe	68
3704	3264	WerFault.exe	68
3184	3264	WerFault.exe	68
3788	3264	WerFault.exe	68
3816	3264	WerFault.exe	68
3552	3264	WerFault.exe	68
3824	3264	WerFault.exe	68
584	3264	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
2232	WerFault.exe
2232	WerFault.exe
2232	WerFault.exe
2232	WerFault.exe
2232	WerFault.exe
2232	WerFault.exe
2232	WerFault.exe
2232	WerFault.exe
2232	WerFault.exe
2232	WerFault.exe
2232	WerFault.exe
2232	WerFault.exe
2232	WerFault.exe
2232	WerFault.exe
2232	WerFault.exe
3184	WerFault.exe
3184	WerFault.exe
3184	WerFault.exe
3184	WerFault.exe
3184	WerFault.exe
3184	WerFault.exe
3184	WerFault.exe
3184	WerFault.exe
3184	WerFault.exe
3184	WerFault.exe
3184	WerFault.exe
3184	WerFault.exe
3184	WerFault.exe
3184	WerFault.exe
3184	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
2372	WerFault.exe
2372	WerFault.exe
2372	WerFault.exe
2372	WerFault.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeRestorePrivilege	1000	WerFault.exe
Token: SeBackupPrivilege	1000	WerFault.exe
Token: SeDebugPrivilege	1000	WerFault.exe
Token: SeDebugPrivilege	2232	WerFault.exe
Token: SeDebugPrivilege	3184	WerFault.exe
Token: SeDebugPrivilege	3872	WerFault.exe
Token: SeDebugPrivilege	2372	WerFault.exe
Token: SeDebugPrivilege	3480	WerFault.exe
Token: SeDebugPrivilege	2164	WerFault.exe
Token: SeDebugPrivilege	3704	WerFault.exe
Token: SeDebugPrivilege	3184	WerFault.exe
Token: SeDebugPrivilege	3788	WerFault.exe
Token: SeDebugPrivilege	3816	WerFault.exe
Token: SeDebugPrivilege	3552	WerFault.exe
Token: SeDebugPrivilege	3824	WerFault.exe
Token: SeDebugPrivilege	584	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5C247288DC99B426FA311A55ED2B47DC.exe
"C:\Users\Admin\AppData\Local\Temp\5C247288DC99B426FA311A55ED2B47DC.exe"
1⤵
- Loads dropped DLL
PID:3264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 732
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 744
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 704
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 916
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 924
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 1212
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 1252
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 1192
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 1252
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 1176
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 1252
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 1248
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 1176
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 1392
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3264-115-0x0000000003E10000-0x0000000003E9F000-memory.dmp

Download

memory/3264-116-0x0000000000400000-0x000000000219E000-memory.dmp

Download