raccoon | ff32e78d84b72b708410771f2ee26fe99ab546dff66411fb12f2be9bfa379378 | Triage

Analysis

max time kernel
110s
max time network
126s
platform
windows10_x64
resource
win10-en-20210920
submitted
30-10-2021 11:16

Sharing

Report Analysis Logs

General

Target

MIX3h1_20211030-120415.exe
Size

459KB
MD5

fa3d5dd2f4a6e706469c24ab71365681
SHA1

aa3871df0bf97472c5a5e0b1edf258cf66ef3b2a
SHA256

ff32e78d84b72b708410771f2ee26fe99ab546dff66411fb12f2be9bfa379378
SHA512

a6dc33fcf970ad565bb982dd31c47c88ffe0ad78975697bdfbb22f36e187bec989bc8311d9602649bfb41a548f0ed9df768acd124a5c2a00876e0b27d6089051

Score

10^/10

raccoon eae58d570cc74796157b14c575bd3adc01116ca0 stealer

Malware Config

Extracted

Family

raccoon

Botnet

eae58d570cc74796157b14c575bd3adc01116ca0

Attributes

url4cnc
http://telegka.top/rino115sipsip
http://telegin.top/rino115sipsip
https://t.me/rino115sipsip

rc4.plain

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 908 created 2144 908 WerFault.exe MIX3h1_20211030-120415.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

908 2144 WerFault.exe MIX3h1_20211030-120415.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
908	WerFault.exe
908	WerFault.exe
908	WerFault.exe
908	WerFault.exe
908	WerFault.exe
908	WerFault.exe
908	WerFault.exe
908	WerFault.exe
908	WerFault.exe
908	WerFault.exe
908	WerFault.exe
908	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 908 WerFault.exe
Token: SeBackupPrivilege 908 WerFault.exe
Token: SeDebugPrivilege 908 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\MIX3h1_20211030-120415.exe
"C:\Users\Admin\AppData\Local\Temp\MIX3h1_20211030-120415.exe"
1⤵
PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 948
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2144-116-0x00000000006E0000-0x000000000076E000-memory.dmp

Filesize
568KB

Download
memory/2144-115-0x00000000004A0000-0x00000000004EE000-memory.dmp

Filesize
312KB

Download
memory/2144-117-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download