raccoon | 193532de47c00c9e4b934badee47b3f6cc8fd7b29c265509102474abfd6db97b | Triage

Analysis

max time kernel
121s
max time network
135s
platform
windows10_x64
resource
win10-en-20210920
submitted
30-10-2021 17:04

Sharing

Report Analysis Logs

General

Target

MIX3h1_20211030-174457.exe
Size

458KB
MD5

17a4417f99be4e1fd6a8aead588964f3
SHA1

1fe65589fc74c80bcedc52eedbd774036f9a5fcb
SHA256

193532de47c00c9e4b934badee47b3f6cc8fd7b29c265509102474abfd6db97b
SHA512

b171879e1d11840814c04718838867ea2b40b6111425844fd622acd9d9ad340be67e6e382e452ee71208379faf007e2f295fc81b7d15ec2823f79b553a67b9cc

Score

10^/10

raccoon eae58d570cc74796157b14c575bd3adc01116ca0 stealer

Malware Config

Extracted

Family

raccoon

Botnet

eae58d570cc74796157b14c575bd3adc01116ca0

Attributes

url4cnc
http://telegka.top/rino115sipsip
http://telegin.top/rino115sipsip
https://t.me/rino115sipsip

rc4.plain

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 2780 created 2620 2780 WerFault.exe MIX3h1_20211030-174457.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2780 2620 WerFault.exe MIX3h1_20211030-174457.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
2780	WerFault.exe
2780	WerFault.exe
2780	WerFault.exe
2780	WerFault.exe
2780	WerFault.exe
2780	WerFault.exe
2780	WerFault.exe
2780	WerFault.exe
2780	WerFault.exe
2780	WerFault.exe
2780	WerFault.exe
2780	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2780 WerFault.exe
Token: SeBackupPrivilege 2780 WerFault.exe
Token: SeDebugPrivilege 2780 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\MIX3h1_20211030-174457.exe
"C:\Users\Admin\AppData\Local\Temp\MIX3h1_20211030-174457.exe"
1⤵
PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 976
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2620-115-0x00000000004A0000-0x000000000054E000-memory.dmp

Filesize
696KB

Download
memory/2620-116-0x0000000000780000-0x000000000080E000-memory.dmp

Filesize
568KB

Download
memory/2620-117-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download