raccoon | 4ac1fd5714d68c3a015611027bd42bd354207d7f9c8417a63a4da31295580ffd | Triage

Analysis

max time kernel
110s
max time network
124s
platform
windows10_x64
resource
win10-en-20211014
submitted
29-10-2021 05:24

Sharing

Report Analysis Logs

General

Target

5fe07134abda38e8870c74150caa6b68.exe
Size

465KB
MD5

5fe07134abda38e8870c74150caa6b68
SHA1

2e50a2dd334ce25c29c09f89e71c42b3242de3ac
SHA256

4ac1fd5714d68c3a015611027bd42bd354207d7f9c8417a63a4da31295580ffd
SHA512

f4088ff3414956574b82f7f8b6f5648eeb924a9c5c9dab687c6187a765aa24652219185c8da7d0214fef566b19ca357fb55a9a878becd4c76f8b97e12006c088

Score

10^/10

raccoon 60e59be328fbd2ebac1839ea99411dccb00a6f49 stealer

Malware Config

Extracted

Family

raccoon

Botnet

60e59be328fbd2ebac1839ea99411dccb00a6f49

Attributes

url4cnc
http://telegin.top/agrybirdsgamerept
http://ttmirror.top/agrybirdsgamerept
http://teletele.top/agrybirdsgamerept
http://telegalive.top/agrybirdsgamerept
http://toptelete.top/agrybirdsgamerept
http://telegraf.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1596 created 2820 1596 WerFault.exe 5fe07134abda38e8870c74150caa6b68.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1596 2820 WerFault.exe 5fe07134abda38e8870c74150caa6b68.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1596 WerFault.exe
Token: SeBackupPrivilege 1596 WerFault.exe
Token: SeDebugPrivilege 1596 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5fe07134abda38e8870c74150caa6b68.exe
"C:\Users\Admin\AppData\Local\Temp\5fe07134abda38e8870c74150caa6b68.exe"
1⤵
PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 992
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2820-116-0x0000000004D40000-0x0000000004DCE000-memory.dmp

Filesize
568KB

Download
memory/2820-115-0x0000000004C70000-0x0000000004CBE000-memory.dmp

Filesize
312KB

Download
memory/2820-117-0x0000000000400000-0x0000000002F3A000-memory.dmp

Filesize
43.2MB

Download