raccoon | 780e39283a52dab8a479fe819f1342cd8ae8c8ada87709006ac834d17e49d662

General

Target

usfive_20211024-013826.exe
Size

818KB
MD5

9589e2ff4d579cc048ad7759213a92f4
SHA1

8cfea7f492b63d606140ee52f7ea2a966ac251dc
SHA256

780e39283a52dab8a479fe819f1342cd8ae8c8ada87709006ac834d17e49d662
SHA512

9f2866786450af6843df87a6c344e4235fa628f84de765de509a735dbab423e6214d75c3bb8bbd19866d8058ca124279567a2619c8e6359dd7481928cdf7ff5c

Score

10^/10

raccoon 7c9b4504a63ed23664e38808e65948379b790395 stealer

Malware Config

Extracted

Family

raccoon

Botnet

7c9b4504a63ed23664e38808e65948379b790395

Attributes

url4cnc
http://telegka.top/capibar
http://telegin.top/capibar
https://t.me/capibar

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1684 created 4056 1684 WerFault.exe usfive_20211024-013826.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

usfive_20211024-013826.exe

description pid process target process

PID 4076 set thread context of 4056 4076 usfive_20211024-013826.exe usfive_20211024-013826.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1684 4056 WerFault.exe usfive_20211024-013826.exe

description	pid	process	target process
PID 1684 created 4056	1684	WerFault.exe	usfive_20211024-013826.exe

description	pid	process	target process
PID 4076 set thread context of 4056	4076	usfive_20211024-013826.exe	usfive_20211024-013826.exe

pid	pid_target	process	target process
1684	4056	WerFault.exe	usfive_20211024-013826.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
1684	WerFault.exe
1684	WerFault.exe
1684	WerFault.exe
1684	WerFault.exe
1684	WerFault.exe
1684	WerFault.exe
1684	WerFault.exe
1684	WerFault.exe
1684	WerFault.exe
1684	WerFault.exe
1684	WerFault.exe
1684	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1684 WerFault.exe
Token: SeBackupPrivilege 1684 WerFault.exe
Token: SeDebugPrivilege 1684 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	1684	WerFault.exe
Token: SeBackupPrivilege	1684	WerFault.exe
Token: SeDebugPrivilege	1684	WerFault.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

usfive_20211024-013826.exe

description	pid	process	target process
PID 4076 wrote to memory of 4056	4076	usfive_20211024-013826.exe	usfive_20211024-013826.exe
PID 4076 wrote to memory of 4056	4076	usfive_20211024-013826.exe	usfive_20211024-013826.exe
PID 4076 wrote to memory of 4056	4076	usfive_20211024-013826.exe	usfive_20211024-013826.exe
PID 4076 wrote to memory of 4056	4076	usfive_20211024-013826.exe	usfive_20211024-013826.exe
PID 4076 wrote to memory of 4056	4076	usfive_20211024-013826.exe	usfive_20211024-013826.exe
PID 4076 wrote to memory of 4056	4076	usfive_20211024-013826.exe	usfive_20211024-013826.exe
PID 4076 wrote to memory of 4056	4076	usfive_20211024-013826.exe	usfive_20211024-013826.exe
PID 4076 wrote to memory of 4056	4076	usfive_20211024-013826.exe	usfive_20211024-013826.exe
PID 4076 wrote to memory of 4056	4076	usfive_20211024-013826.exe	usfive_20211024-013826.exe

C:\Users\Admin\AppData\Local\Temp\usfive_20211024-013826.exe
"C:\Users\Admin\AppData\Local\Temp\usfive_20211024-013826.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4076

C:\Users\Admin\AppData\Local\Temp\usfive_20211024-013826.exe
"C:\Users\Admin\AppData\Local\Temp\usfive_20211024-013826.exe"
2⤵
PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 900
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4056-118-0x0000000000457320-mapping.dmp

Download
memory/4056-117-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/4056-122-0x00000000030F4000-0x0000000003143000-memory.dmp

Filesize
316KB

Download
memory/4056-123-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/4056-125-0x0000000002DF0000-0x0000000002F3A000-memory.dmp

Filesize
1.3MB

Download
memory/4056-124-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/4056-126-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/4076-115-0x0000000000B6C000-0x0000000000BF4000-memory.dmp

Filesize
544KB

Download
memory/4076-116-0x0000000000981000-0x00000000009EA000-memory.dmp

Filesize
420KB

Download
memory/4076-119-0x0000000000C00000-0x0000000000CAD000-memory.dmp

Filesize
692KB

Download
memory/4076-121-0x0000000000CB0000-0x0000000000D43000-memory.dmp

Filesize
588KB

Download
memory/4076-120-0x0000000000400000-0x00000000008FC000-memory.dmp

Filesize
5.0MB

Download

Analysis

Sharing