raccoon | 46e130de5d270cbb370fa222a1b3819bb5413d19aabb2d576dcdab524972bf0d | Triage

Analysis

max time kernel
101s
max time network
127s
platform
windows10_x64
resource
win10-en-20211014
submitted
30-10-2021 11:16

Sharing

Report Analysis Logs

General

Target

MIX3h1_20211030-123542.exe
Size

459KB
MD5

12b586d510b0f4dea6305d44ff6d7ad4
SHA1

5ba3751061e22a5cccdf86355353f8c6dd1f7a66
SHA256

46e130de5d270cbb370fa222a1b3819bb5413d19aabb2d576dcdab524972bf0d
SHA512

a501b16885978a48801650b224fe24daa9f7d8cdf2bb805a25fe572a064719e7d3660d3d1ceafb12ac9fc9edad3e70a5adab9f002e7e696cfd23c18a738e011e

Score

10^/10

raccoon eae58d570cc74796157b14c575bd3adc01116ca0 stealer

Malware Config

Extracted

Family

raccoon

Botnet

eae58d570cc74796157b14c575bd3adc01116ca0

Attributes

url4cnc
http://telegka.top/rino115sipsip
http://telegin.top/rino115sipsip
https://t.me/rino115sipsip

rc4.plain

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 548 created 4192 548 WerFault.exe MIX3h1_20211030-123542.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

548 4192 WerFault.exe MIX3h1_20211030-123542.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
548	WerFault.exe
548	WerFault.exe
548	WerFault.exe
548	WerFault.exe
548	WerFault.exe
548	WerFault.exe
548	WerFault.exe
548	WerFault.exe
548	WerFault.exe
548	WerFault.exe
548	WerFault.exe
548	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 548 WerFault.exe
Token: SeBackupPrivilege 548 WerFault.exe
Token: SeDebugPrivilege 548 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\MIX3h1_20211030-123542.exe
"C:\Users\Admin\AppData\Local\Temp\MIX3h1_20211030-123542.exe"
1⤵
PID:4192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 968
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4192-115-0x00000000004A0000-0x00000000004EE000-memory.dmp

Filesize
312KB

Download
memory/4192-116-0x0000000000770000-0x00000000007FE000-memory.dmp

Filesize
568KB

Download
memory/4192-117-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download