raccoon | 505cbc7ff89de44084e926ead2fec2e7782cd018267266e899436cbde8c3c39b | Triage

Analysis

max time kernel
110s
max time network
148s
platform
windows10_x64
resource
win10-en-20210920
submitted
30-10-2021 11:16

Sharing

Report Analysis Logs

General

Target

MIX3h1_20211030-065543.exe
Size

459KB
MD5

ec8da97e6896d173298c5cdd03f84b3f
SHA1

96f2bd0090230116b63e8cea5851d94fd5509693
SHA256

505cbc7ff89de44084e926ead2fec2e7782cd018267266e899436cbde8c3c39b
SHA512

1ffcb8521f721521e32415a4d0f729c9bec0598181a5bb6ef3d963fa4fd38b95002a8574ca1e131feae2d367caded4a588e485724978b9d4cb56c74ffae4edf6

Score

10^/10

raccoon eae58d570cc74796157b14c575bd3adc01116ca0 stealer

Malware Config

Extracted

Family

raccoon

Botnet

eae58d570cc74796157b14c575bd3adc01116ca0

Attributes

url4cnc
http://telegka.top/rino115sipsip
http://telegin.top/rino115sipsip
https://t.me/rino115sipsip

rc4.plain

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3908 created 2808 3908 WerFault.exe MIX3h1_20211030-065543.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3908 2808 WerFault.exe MIX3h1_20211030-065543.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
3908	WerFault.exe
3908	WerFault.exe
3908	WerFault.exe
3908	WerFault.exe
3908	WerFault.exe
3908	WerFault.exe
3908	WerFault.exe
3908	WerFault.exe
3908	WerFault.exe
3908	WerFault.exe
3908	WerFault.exe
3908	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3908 WerFault.exe
Token: SeBackupPrivilege 3908 WerFault.exe
Token: SeDebugPrivilege 3908 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\MIX3h1_20211030-065543.exe
"C:\Users\Admin\AppData\Local\Temp\MIX3h1_20211030-065543.exe"
1⤵
PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 1228
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2808-115-0x00000000004A0000-0x00000000004EE000-memory.dmp

Filesize
312KB

Download
memory/2808-116-0x0000000000710000-0x000000000079E000-memory.dmp

Filesize
568KB

Download
memory/2808-117-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download