raccoon | b0e37566690fc65b62845c25c98193e0670582ee7b310bba13e4b32a0183c484 | Triage

Analysis

max time kernel
110s
max time network
124s
platform
windows10_x64
resource
win10-en-20210920
submitted
30-10-2021 14:15

Sharing

Report Analysis Logs

General

Target

MIX3h1_20211030-133720.exe
Size

459KB
MD5

a101c47afb0f68ca9e536d183040c339
SHA1

d341de58afd8441063660f9c393dbace86cb287f
SHA256

b0e37566690fc65b62845c25c98193e0670582ee7b310bba13e4b32a0183c484
SHA512

5afa8e17c4ca4ec5d78760999f3befc04e2e9c4270cf990a94ff55721a940b379a56c5b3533cfd00cb79d814f7560a0436bf1d1f8f39a6d696c3becdc5d79096

Score

10^/10

raccoon eae58d570cc74796157b14c575bd3adc01116ca0 stealer

Malware Config

Extracted

Family

raccoon

Botnet

eae58d570cc74796157b14c575bd3adc01116ca0

Attributes

url4cnc
http://telegka.top/rino115sipsip
http://telegin.top/rino115sipsip
https://t.me/rino115sipsip

rc4.plain

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 628 created 1864 628 WerFault.exe MIX3h1_20211030-133720.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

628 1864 WerFault.exe MIX3h1_20211030-133720.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
628	WerFault.exe
628	WerFault.exe
628	WerFault.exe
628	WerFault.exe
628	WerFault.exe
628	WerFault.exe
628	WerFault.exe
628	WerFault.exe
628	WerFault.exe
628	WerFault.exe
628	WerFault.exe
628	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 628 WerFault.exe
Token: SeBackupPrivilege 628 WerFault.exe
Token: SeDebugPrivilege 628 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\MIX3h1_20211030-133720.exe
"C:\Users\Admin\AppData\Local\Temp\MIX3h1_20211030-133720.exe"
1⤵
PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 1244
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1864-116-0x0000000000730000-0x00000000007BE000-memory.dmp

Filesize
568KB

Download
memory/1864-115-0x00000000005C0000-0x000000000070A000-memory.dmp

Filesize
1.3MB

Download
memory/1864-117-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download