raccoon | d1e29d1206b6d74e8617f768bb43aea7d352a477b743ae98205909109983f645 | Triage

Analysis

max time kernel
119s
max time network
124s
submitted
01-01-1970 00:00

Sharing

Report Analysis Logs

General

Target

1ffb547f14e373312937f6d8c60fffd5.exe
Size

589KB
MD5

1ffb547f14e373312937f6d8c60fffd5
SHA1

44fde78fa67818a9420477cf321b38a280888bbb
SHA256

d1e29d1206b6d74e8617f768bb43aea7d352a477b743ae98205909109983f645
SHA512

c60e35398fb67b0840b904861051ec1b2e829dcb0557fb2cfee6a0a0978cb180c7f74c1d60194ecfd49c01a226ad761b06b306675bb02dceb4b3a770e4d1f9e4

Score

10^/10

raccoon 60e59be328fbd2ebac1839ea99411dccb00a6f49 stealer

Malware Config

Extracted

Family

raccoon

Botnet

60e59be328fbd2ebac1839ea99411dccb00a6f49

Attributes

url4cnc
http://telegin.top/agrybirdsgamerept
http://ttmirror.top/agrybirdsgamerept
http://teletele.top/agrybirdsgamerept
http://telegalive.top/agrybirdsgamerept
http://toptelete.top/agrybirdsgamerept
http://telegraf.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 996 created 3464 996 WerFault.exe 1ffb547f14e373312937f6d8c60fffd5.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

996 3464 WerFault.exe 1ffb547f14e373312937f6d8c60fffd5.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 996 WerFault.exe
Token: SeBackupPrivilege 996 WerFault.exe
Token: SeDebugPrivilege 996 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1ffb547f14e373312937f6d8c60fffd5.exe
"C:\Users\Admin\AppData\Local\Temp\1ffb547f14e373312937f6d8c60fffd5.exe"
1⤵
PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 968
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3464-115-0x0000000002ED9000-0x0000000002F28000-memory.dmp

Filesize
316KB

Download
memory/3464-116-0x0000000004860000-0x00000000048EE000-memory.dmp

Filesize
568KB

Download
memory/3464-117-0x0000000000400000-0x0000000002BED000-memory.dmp

Filesize
39.9MB

Download