raccoon | 58c1b22873a1eab4f8a7cc5a26085a2968637eaa3f22e7cbe8032ad6f25bbd38 | Triage

Analysis

max time kernel
122s
max time network
124s
platform
windows10_x64
resource
win10-en-20211104
submitted
07-11-2021 08:13

Sharing

Report Analysis Logs

General

Target

65ecbb1c38b4ac891d8a90870e115398.exe
Size

591KB
MD5

65ecbb1c38b4ac891d8a90870e115398
SHA1

78e3f1782d238b6375224a3ce7793b1cb08a95d4
SHA256

58c1b22873a1eab4f8a7cc5a26085a2968637eaa3f22e7cbe8032ad6f25bbd38
SHA512

a95b0ccaecdf007c4590efde4e56ec4e65b8d900e2070726393b912f4ef37b3761a641e7c85dfe8a9698f1bf9864afc8613d956e14414d5a0c78c00aa17a7dd9

Score

10^/10

raccoon a741159db87f9df2b687764994c63c4c859ea476 stealer

Malware Config

Extracted

Family

raccoon

Version

1.8.3

Botnet

a741159db87f9df2b687764994c63c4c859ea476

Attributes

url4cnc
http://178.23.190.57/hiioBlacklight1
http://91.219.236.162/hiioBlacklight1
http://185.163.47.176/hiioBlacklight1
http://193.38.54.238/hiioBlacklight1
http://74.119.192.122/hiioBlacklight1
http://91.219.236.240/hiioBlacklight1
https://t.me/hiioBlacklight1

rc4.plain

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 4640 created 4348 4640 WerFault.exe 65ecbb1c38b4ac891d8a90870e115398.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4640 4348 WerFault.exe 65ecbb1c38b4ac891d8a90870e115398.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
4640	WerFault.exe
4640	WerFault.exe
4640	WerFault.exe
4640	WerFault.exe
4640	WerFault.exe
4640	WerFault.exe
4640	WerFault.exe
4640	WerFault.exe
4640	WerFault.exe
4640	WerFault.exe
4640	WerFault.exe
4640	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 4640 WerFault.exe
Token: SeBackupPrivilege 4640 WerFault.exe
Token: SeDebugPrivilege 4640 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\65ecbb1c38b4ac891d8a90870e115398.exe
"C:\Users\Admin\AppData\Local\Temp\65ecbb1c38b4ac891d8a90870e115398.exe"
1⤵
PID:4348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 892
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4348-118-0x0000000000BF9000-0x0000000000C48000-memory.dmp

Filesize
316KB

Download
memory/4348-119-0x0000000002680000-0x000000000270F000-memory.dmp

Filesize
572KB

Download
memory/4348-120-0x0000000000400000-0x0000000000937000-memory.dmp

Filesize
5.2MB

Download