raccoon | e079da0f750cdb631d242e0c473e2b3b9384256ad256d7aef51e34b29555c8d6 | Triage

Analysis

max time kernel
110s
max time network
129s
platform
windows10_x64
resource
win10-en-20210920
submitted
26-10-2021 19:37

Sharing

Report Analysis Logs

General

Target

169f798cf5f0ae7ae21e0b4716b33d0c.exe
Size

464KB
MD5

169f798cf5f0ae7ae21e0b4716b33d0c
SHA1

a3ba41b4439e2cdece93d87f0a62cbef810e7a51
SHA256

e079da0f750cdb631d242e0c473e2b3b9384256ad256d7aef51e34b29555c8d6
SHA512

b946663eaa9bc80ec6a1c885f5295034d8461328501526e7a33c29adcbcbb1f313f66a0fd8c32b90990e52e7780ab540fc7b85f4ed8d60bb082353575ef4c303

Score

10^/10

raccoon 60e59be328fbd2ebac1839ea99411dccb00a6f49 stealer

Malware Config

Extracted

Family

raccoon

Botnet

60e59be328fbd2ebac1839ea99411dccb00a6f49

Attributes

url4cnc
http://telegin.top/agrybirdsgamerept
http://ttmirror.top/agrybirdsgamerept
http://teletele.top/agrybirdsgamerept
http://telegalive.top/agrybirdsgamerept
http://toptelete.top/agrybirdsgamerept
http://telegraf.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3936 created 784 3936 WerFault.exe 169f798cf5f0ae7ae21e0b4716b33d0c.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3936 784 WerFault.exe 169f798cf5f0ae7ae21e0b4716b33d0c.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3936 WerFault.exe
Token: SeBackupPrivilege 3936 WerFault.exe
Token: SeDebugPrivilege 3936 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\169f798cf5f0ae7ae21e0b4716b33d0c.exe
"C:\Users\Admin\AppData\Local\Temp\169f798cf5f0ae7ae21e0b4716b33d0c.exe"
1⤵
PID:784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 784 -s 992
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/784-116-0x0000000004BC0000-0x0000000004C4E000-memory.dmp

Filesize
568KB

Download
memory/784-115-0x00000000030C0000-0x000000000310E000-memory.dmp

Filesize
312KB

Download
memory/784-117-0x0000000000400000-0x0000000002F3A000-memory.dmp

Filesize
43.2MB

Download