raccoon | 55927123aaddfc0c7d7b720e0f06aadd5bcc52d9b4955da3460b02561fb6447d | Triage

Analysis

max time kernel
80s
max time network
137s
platform
windows10_x64
resource
win10-en-20210920
submitted
14-10-2021 06:13

Sharing

Report Analysis Logs

General

Target

5bdc0766d86a74e58055a3940a27feca.exe
Size

560KB
MD5

5bdc0766d86a74e58055a3940a27feca
SHA1

efa03d9af76c4cc13fac9dfeaa173e662beca5d5
SHA256

55927123aaddfc0c7d7b720e0f06aadd5bcc52d9b4955da3460b02561fb6447d
SHA512

bd62121c5162ae11001d8200f7100d5eb734d69b3205adad73a7b19e96864194d4e9c385e0d97c5b22d6474b6febdee2857f9dc7c880b793a91b0c15aa33cded

Score

10^/10

raccoon 7ebf9b416b72a203df65383eec899dc689d2c3d7 stealer

Malware Config

Extracted

Family

raccoon

Botnet

7ebf9b416b72a203df65383eec899dc689d2c3d7

Attributes

url4cnc
http://telegatt.top/agrybirdsgamerept
http://telegka.top/agrybirdsgamerept
http://telegin.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 584 created 2416 584 WerFault.exe 5bdc0766d86a74e58055a3940a27feca.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

584 2416 WerFault.exe 5bdc0766d86a74e58055a3940a27feca.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 584 WerFault.exe
Token: SeBackupPrivilege 584 WerFault.exe
Token: SeDebugPrivilege 584 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5bdc0766d86a74e58055a3940a27feca.exe
"C:\Users\Admin\AppData\Local\Temp\5bdc0766d86a74e58055a3940a27feca.exe"
1⤵
PID:2416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 932
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2416-115-0x00000000018F6000-0x0000000001945000-memory.dmp

Filesize
316KB

Download
memory/2416-116-0x0000000003380000-0x000000000340E000-memory.dmp

Filesize
568KB

Download
memory/2416-117-0x0000000000400000-0x00000000016FF000-memory.dmp

Filesize
19.0MB

Download