raccoon | 596e838294aa3618fd5a6e8d71ae615f549a9df857745c41515134f748f68ef3 | Triage

Analysis

max time kernel
146s
max time network
148s
platform
windows10_x64
resource
win10-en-20211104
submitted
08-11-2021 13:38

Sharing

Report Analysis Logs

General

Target

8fbe2112d360c6a0f0b18be369b9951a.exe
Size

534KB
MD5

8fbe2112d360c6a0f0b18be369b9951a
SHA1

fde28c60ea0938c49928d60d75f5adcd76f84903
SHA256

596e838294aa3618fd5a6e8d71ae615f549a9df857745c41515134f748f68ef3
SHA512

ec59f9b7b3d5242fb58b95dd31de7f180e006c6d37de24763b127f6e7840a78a77fbeab900a88c010c6227c25ec484ecd8381cbc989e1a96ed603f38a8e4d38f

Score

10^/10

raccoon 243f5e3056753d9f9706258dce4f79e57c3a9c44 stealer

Malware Config

Extracted

Family

raccoon

Version

1.8.3

Botnet

243f5e3056753d9f9706258dce4f79e57c3a9c44

Attributes

url4cnc
http://178.23.190.57/agrybirdsgamerept

http://91.219.236.162/agrybirdsgamerept

http://185.163.47.176/agrybirdsgamerept

http://193.38.54.238/agrybirdsgamerept

http://74.119.192.122/agrybirdsgamerept

http://91.219.236.240/agrybirdsgamerept

rc4.plain

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1912 created 2564 1912 WerFault.exe 8fbe2112d360c6a0f0b18be369b9951a.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1912 2564 WerFault.exe 8fbe2112d360c6a0f0b18be369b9951a.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
1912	WerFault.exe
1912	WerFault.exe
1912	WerFault.exe
1912	WerFault.exe
1912	WerFault.exe
1912	WerFault.exe
1912	WerFault.exe
1912	WerFault.exe
1912	WerFault.exe
1912	WerFault.exe
1912	WerFault.exe
1912	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1912 WerFault.exe
Token: SeBackupPrivilege 1912 WerFault.exe
Token: SeDebugPrivilege 1912 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8fbe2112d360c6a0f0b18be369b9951a.exe
"C:\Users\Admin\AppData\Local\Temp\8fbe2112d360c6a0f0b18be369b9951a.exe"
1⤵
PID:2564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 984
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2564-118-0x0000000002200000-0x000000000224F000-memory.dmp

Filesize
316KB

Download
memory/2564-119-0x0000000002250000-0x00000000022DF000-memory.dmp

Filesize
572KB

Download
memory/2564-120-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download