raccoon | d004a793d71800e6358a7dc5322b8bc226739828bb9dfe8d2f62387412670d70 | Triage

Analysis

max time kernel
120s
max time network
124s
submitted
01-01-1970 00:00

Sharing

Report Analysis Logs

General

Target

2afcb892c0114000ef9664e45d1aea15.exe
Size

465KB
MD5

2afcb892c0114000ef9664e45d1aea15
SHA1

b6f0dd26ffce6dd5cd74779cdd61b208ed0a6414
SHA256

d004a793d71800e6358a7dc5322b8bc226739828bb9dfe8d2f62387412670d70
SHA512

e7d702abc0b7c130b5d26736701597998cf0c55ce5533806a23380c742416be7a59b49f391ea2cff0a3fc75984ba3714506a918a32077944ddb0c0ef745395b5

Score

10^/10

raccoon 60e59be328fbd2ebac1839ea99411dccb00a6f49 stealer

Malware Config

Extracted

Family

raccoon

Botnet

60e59be328fbd2ebac1839ea99411dccb00a6f49

Attributes

url4cnc
http://telegin.top/agrybirdsgamerept
http://ttmirror.top/agrybirdsgamerept
http://teletele.top/agrybirdsgamerept
http://telegalive.top/agrybirdsgamerept
http://toptelete.top/agrybirdsgamerept
http://telegraf.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3932 created 748 3932 WerFault.exe 2afcb892c0114000ef9664e45d1aea15.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3932 748 WerFault.exe 2afcb892c0114000ef9664e45d1aea15.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3932	WerFault.exe
3932	WerFault.exe
3932	WerFault.exe
3932	WerFault.exe
3932	WerFault.exe
3932	WerFault.exe
3932	WerFault.exe
3932	WerFault.exe
3932	WerFault.exe
3932	WerFault.exe
3932	WerFault.exe
3932	WerFault.exe
3932	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3932 WerFault.exe
Token: SeBackupPrivilege 3932 WerFault.exe
Token: SeDebugPrivilege 3932 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2afcb892c0114000ef9664e45d1aea15.exe
"C:\Users\Admin\AppData\Local\Temp\2afcb892c0114000ef9664e45d1aea15.exe"
1⤵
PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 932
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-116-0x0000000003200000-0x000000000328E000-memory.dmp

Filesize
568KB

Download
memory/748-115-0x0000000002F40000-0x000000000308A000-memory.dmp

Filesize
1.3MB

Download
memory/748-117-0x0000000000400000-0x0000000002F3A000-memory.dmp

Filesize
43.2MB

Download