raccoon | 50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781

General

Target

50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe
Size

420KB
MD5

a90a80c186b10f2faa4d87be2241de2e
SHA1

e2e71991a01febea6f9b55b7d7137dc6405be6e8
SHA256

50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781
SHA512

0aee887846f94bd3b1435ff5ce859b56378de44b6464f289531392dce385c24f1faa1e1d24db72bca2e6f5d16661fc297ade755ff6b7d461b8939ec618fb1898

Score

10^/10

raccoon b3ed1d79826001317754d88a62db05820a1ecd19 stealer

Malware Config

Extracted

Family

raccoon

Botnet

b3ed1d79826001317754d88a62db05820a1ecd19

Attributes

url4cnc
http://teleliver.top/agrybirdsgamerept
http://livetelive.top/agrybirdsgamerept
http://teleger.top/agrybirdsgamerept
http://telestrong.top/agrybirdsgamerept
http://tgrampro.top/agrybirdsgamerept
http://teleghost.top/agrybirdsgamerept
http://teleroom.top/agrybirdsgamerept
http://telemir.top/agrybirdsgamerept
http://teletelo.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of SetThreadContext 1 IoCs

Processes:

50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe

description	pid	process	target process
PID 2820 set thread context of 4028	2820	50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe	50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1428 4028 WerFault.exe 50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe

pid	pid_target	process	target process
1428	4028	WerFault.exe	50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
1428	WerFault.exe
1428	WerFault.exe
1428	WerFault.exe
1428	WerFault.exe
1428	WerFault.exe
1428	WerFault.exe
1428	WerFault.exe
1428	WerFault.exe
1428	WerFault.exe
1428	WerFault.exe
1428	WerFault.exe
1428	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1428 WerFault.exe
Token: SeBackupPrivilege 1428 WerFault.exe
Token: SeDebugPrivilege 1428 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	1428	WerFault.exe
Token: SeBackupPrivilege	1428	WerFault.exe
Token: SeDebugPrivilege	1428	WerFault.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe

description	pid	process	target process
PID 2820 wrote to memory of 4028	2820	50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe	50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe
PID 2820 wrote to memory of 4028	2820	50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe	50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe
PID 2820 wrote to memory of 4028	2820	50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe	50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe
PID 2820 wrote to memory of 4028	2820	50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe	50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe
PID 2820 wrote to memory of 4028	2820	50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe	50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe
PID 2820 wrote to memory of 4028	2820	50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe	50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe
PID 2820 wrote to memory of 4028	2820	50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe	50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe
PID 2820 wrote to memory of 4028	2820	50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe	50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe
PID 2820 wrote to memory of 4028	2820	50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe	50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe

C:\Users\Admin\AppData\Local\Temp\50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe
"C:\Users\Admin\AppData\Local\Temp\50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2820

C:\Users\Admin\AppData\Local\Temp\50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe
"C:\Users\Admin\AppData\Local\Temp\50eb30c009276e0375677518f6a240b50b1ace36362a8ca0601cd5e6d04d4781.exe"
2⤵
PID:4028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 184
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2820-117-0x00000000020F0000-0x000000000213E000-memory.dmp

Filesize
312KB

Download
memory/2820-118-0x0000000002140000-0x00000000021CE000-memory.dmp

Filesize
568KB

Download
memory/4028-115-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4028-116-0x000000000043E9BE-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads