raccoon | 678acb0210b49178697f000aa87619018626bb64ed483690bb266d942e0f5c1e | Triage

Analysis

max time kernel
62s
max time network
151s
platform
windows10_x64
resource
win10-en-20211014
submitted
30-10-2021 00:37

Sharing

Report Analysis Logs

General

Target

54d61c8728f2b5872675212017a5e0e7.exe
Size

582KB
MD5

54d61c8728f2b5872675212017a5e0e7
SHA1

ea3fe4632335c7fe5c883a64007ba1f3180d8999
SHA256

678acb0210b49178697f000aa87619018626bb64ed483690bb266d942e0f5c1e
SHA512

af22e75a31b3309dee47e6833125194d52bc7b1249c9709324a5eb3da6d9b5cf6c03a33c2394d948a97e5aabf8964c489efb0ce4cf44664be5ee54501587db7a

Score

10^/10

raccoon 7c9b4504a63ed23664e38808e65948379b790395 stealer

Malware Config

Extracted

Family

raccoon

Botnet

7c9b4504a63ed23664e38808e65948379b790395

Attributes

url4cnc
http://telegka.top/capibar
http://telegin.top/capibar
https://t.me/capibar

rc4.plain

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 360 created 3152 360 WerFault.exe 54d61c8728f2b5872675212017a5e0e7.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

360 3152 WerFault.exe 54d61c8728f2b5872675212017a5e0e7.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 360 WerFault.exe
Token: SeBackupPrivilege 360 WerFault.exe
Token: SeDebugPrivilege 360 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\54d61c8728f2b5872675212017a5e0e7.exe
"C:\Users\Admin\AppData\Local\Temp\54d61c8728f2b5872675212017a5e0e7.exe"
1⤵
PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 928
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3152-116-0x0000000003030000-0x00000000030BE000-memory.dmp

Filesize
568KB

Download
memory/3152-117-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download