raccoon | 6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a

General

Target

6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe
Size

422KB
MD5

5e7c8ac5d567f7380460e16d3382308b
SHA1

8c35cc0fcae2766146af69516fb764bf25a414cf
SHA256

6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a
SHA512

58dd0eea104ce67a4831d9a70c7b0dda58c81c09250976a0339239a9b567959364f37eef44286676db6a289ab704d41d28da4f9b63c55c869bc867c7ced87f25

Score

10^/10

raccoon b3ed1d79826001317754d88a62db05820a1ecd19 stealer

Malware Config

Extracted

Family

raccoon

Botnet

b3ed1d79826001317754d88a62db05820a1ecd19

Attributes

url4cnc
http://teleliver.top/agrybirdsgamerept
http://livetelive.top/agrybirdsgamerept
http://teleger.top/agrybirdsgamerept
http://telestrong.top/agrybirdsgamerept
http://tgrampro.top/agrybirdsgamerept
http://teleghost.top/agrybirdsgamerept
http://teleroom.top/agrybirdsgamerept
http://telemir.top/agrybirdsgamerept
http://teletelo.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of SetThreadContext 1 IoCs

Processes:

6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe

description	pid	process	target process
PID 3464 set thread context of 2256	3464	6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe	6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

868 2256 WerFault.exe 6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe

pid	pid_target	process	target process
868	2256	WerFault.exe	6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
868	WerFault.exe
868	WerFault.exe
868	WerFault.exe
868	WerFault.exe
868	WerFault.exe
868	WerFault.exe
868	WerFault.exe
868	WerFault.exe
868	WerFault.exe
868	WerFault.exe
868	WerFault.exe
868	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 868 WerFault.exe
Token: SeBackupPrivilege 868 WerFault.exe
Token: SeDebugPrivilege 868 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	868	WerFault.exe
Token: SeBackupPrivilege	868	WerFault.exe
Token: SeDebugPrivilege	868	WerFault.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe

description	pid	process	target process
PID 3464 wrote to memory of 2256	3464	6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe	6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe
PID 3464 wrote to memory of 2256	3464	6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe	6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe
PID 3464 wrote to memory of 2256	3464	6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe	6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe
PID 3464 wrote to memory of 2256	3464	6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe	6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe
PID 3464 wrote to memory of 2256	3464	6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe	6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe
PID 3464 wrote to memory of 2256	3464	6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe	6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe
PID 3464 wrote to memory of 2256	3464	6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe	6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe
PID 3464 wrote to memory of 2256	3464	6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe	6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe
PID 3464 wrote to memory of 2256	3464	6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe	6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe

C:\Users\Admin\AppData\Local\Temp\6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe
"C:\Users\Admin\AppData\Local\Temp\6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3464

C:\Users\Admin\AppData\Local\Temp\6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe
"C:\Users\Admin\AppData\Local\Temp\6f057dd71ebe1f5a1482cd5ee0e3994545196829d07fba3e5341ef5eaea3191a.exe"
2⤵
PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 184
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2256-116-0x000000000043E9BE-mapping.dmp

Download
memory/2256-115-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/3464-118-0x0000000002160000-0x00000000021EE000-memory.dmp

Filesize
568KB

Download
memory/3464-117-0x0000000000480000-0x00000000005CA000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads