raccoon | 64771bf8e0a5d9626795cf4f1172cfaed594ce61defb10f9057fd14e83dff4c5 | Triage

Analysis

max time kernel
121s
max time network
135s
platform
windows10_x64
resource
win10-en-20210920
submitted
28-10-2021 19:52

Sharing

Report Analysis Logs

General

Target

cf6a0a6ec4292770c93bf9b8ada7af4b.exe
Size

450KB
MD5

cf6a0a6ec4292770c93bf9b8ada7af4b
SHA1

a540699e685cfa98935aff5b52a1dd9fd8ec7783
SHA256

64771bf8e0a5d9626795cf4f1172cfaed594ce61defb10f9057fd14e83dff4c5
SHA512

a72b56d0a64ca21fec21e7ab0c695d18e852d198b19c49516d32e95baa40684334bb579e2644c2727fa2a966858299dd0342d9a4ae1c8d485c73734b860af46b

Score

10^/10

raccoon 60e59be328fbd2ebac1839ea99411dccb00a6f49 stealer

Malware Config

Extracted

Family

raccoon

Botnet

60e59be328fbd2ebac1839ea99411dccb00a6f49

Attributes

url4cnc
http://telegin.top/agrybirdsgamerept
http://ttmirror.top/agrybirdsgamerept
http://teletele.top/agrybirdsgamerept
http://telegalive.top/agrybirdsgamerept
http://toptelete.top/agrybirdsgamerept
http://telegraf.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 8 created 2664 8 WerFault.exe cf6a0a6ec4292770c93bf9b8ada7af4b.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

8 2664 WerFault.exe cf6a0a6ec4292770c93bf9b8ada7af4b.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 8 WerFault.exe
Token: SeBackupPrivilege 8 WerFault.exe
Token: SeDebugPrivilege 8 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\cf6a0a6ec4292770c93bf9b8ada7af4b.exe
"C:\Users\Admin\AppData\Local\Temp\cf6a0a6ec4292770c93bf9b8ada7af4b.exe"
1⤵
PID:2664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 996
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2664-116-0x0000000003230000-0x00000000032BE000-memory.dmp

Filesize
568KB

Download
memory/2664-115-0x0000000002FC0000-0x000000000310A000-memory.dmp

Filesize
1.3MB

Download
memory/2664-117-0x0000000000400000-0x0000000002F36000-memory.dmp

Filesize
43.2MB

Download