raccoon | 0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e

General

Target

0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe
Size

421KB
MD5

cac7e11a6deb07701f5c87d07affcca2
SHA1

789a9d70281d70a50e0452d85cb3cb2329ea5254
SHA256

0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e
SHA512

3349ffa7747d612c698619dd7b385805f843998f05ed513a7b4f0510633fe4a930fa21022aa616e6a7a3dba0c844c9cb28f9b7ccfb879a75465b7ea6432754a5

Score

10^/10

raccoon b3ed1d79826001317754d88a62db05820a1ecd19 stealer

Malware Config

Extracted

Family

raccoon

Botnet

b3ed1d79826001317754d88a62db05820a1ecd19

Attributes

url4cnc
http://teleliver.top/agrybirdsgamerept

http://livetelive.top/agrybirdsgamerept

http://teleger.top/agrybirdsgamerept

http://telestrong.top/agrybirdsgamerept

http://tgrampro.top/agrybirdsgamerept

http://teleghost.top/agrybirdsgamerept

http://teleroom.top/agrybirdsgamerept

http://telemir.top/agrybirdsgamerept

http://teletelo.top/agrybirdsgamerept

https://t.me/agrybirdsgamerept

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of SetThreadContext 1 IoCs

Processes:

0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe

description	pid	process	target process
PID 3632 set thread context of 4192	3632	0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe	0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3396 4192 WerFault.exe 0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe

pid	pid_target	process	target process
3396	4192	WerFault.exe	0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
3396	WerFault.exe
3396	WerFault.exe
3396	WerFault.exe
3396	WerFault.exe
3396	WerFault.exe
3396	WerFault.exe
3396	WerFault.exe
3396	WerFault.exe
3396	WerFault.exe
3396	WerFault.exe
3396	WerFault.exe
3396	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3396 WerFault.exe
Token: SeBackupPrivilege 3396 WerFault.exe
Token: SeDebugPrivilege 3396 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3396	WerFault.exe
Token: SeBackupPrivilege	3396	WerFault.exe
Token: SeDebugPrivilege	3396	WerFault.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe

description	pid	process	target process
PID 3632 wrote to memory of 4192	3632	0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe	0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe
PID 3632 wrote to memory of 4192	3632	0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe	0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe
PID 3632 wrote to memory of 4192	3632	0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe	0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe
PID 3632 wrote to memory of 4192	3632	0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe	0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe
PID 3632 wrote to memory of 4192	3632	0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe	0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe
PID 3632 wrote to memory of 4192	3632	0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe	0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe
PID 3632 wrote to memory of 4192	3632	0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe	0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe
PID 3632 wrote to memory of 4192	3632	0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe	0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe
PID 3632 wrote to memory of 4192	3632	0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe	0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe

C:\Users\Admin\AppData\Local\Temp\0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe
"C:\Users\Admin\AppData\Local\Temp\0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3632

C:\Users\Admin\AppData\Local\Temp\0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe
"C:\Users\Admin\AppData\Local\Temp\0347dfd075cb14d0381d308d86b4c0538029babc470e0ba4e6b036c47aa47e7e.exe"
2⤵
PID:4192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 184
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3632-117-0x0000000002190000-0x00000000021DE000-memory.dmp

Filesize
312KB

Download
memory/3632-118-0x00000000021E0000-0x000000000226E000-memory.dmp

Filesize
568KB

Download
memory/4192-116-0x000000000043E9BE-mapping.dmp

Download
memory/4192-115-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads