raccoon | 2ddd23a3f10c202c4814ded80e326091c23be36f828c6e25e0a78ad34657a733

Analysis

max time kernel
129s
max time network
121s
platform
windows7_x64
resource
win7-en-20211014
submitted
09/11/2021, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f2b12cdd331f320e87f4dfc712740eec.exe
Size 509KB
Sample211109-cs1ajaeeb4
SHA256 2ddd23a3f10c202c4814ded80e326091c23be36f828c6e25e0a78ad34657a733
MD5 f2b12cdd331f320e87f4dfc712740eec
SHA1 a8d437458ee415ba95a4ce771291240ed12b6f19
SHA512 70405e9ee026eb25016fc8d5f1c88de241ac07fcd42db7f9cfd2cd79629ca8dce0a4260a8b576367e70b1d9e25734d31814480b194321798e389677a71a74632
MD5 SHA1 SHA512

Score

10^/10

raccoon d4d445f09abd00ad30681d6fb869e8ac910a67e2 stealer

Malware Config

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

d4d445f09abd00ad30681d6fb869e8ac910a67e2

Attributes

url4cnc
http://178.23.190.57/jdiamond13

http://91.219.236.162/jdiamond13

http://185.163.47.176/jdiamond13

http://193.38.54.238/jdiamond13

http://74.119.192.122/jdiamond13

http://91.219.236.240/jdiamond13

https://t.me/jdiamond13

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Program crash 1 IoCs

pid	pid_target	Process	procid_target
624	1660	WerFault.exe	14

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
624	WerFault.exe
624	WerFault.exe
624	WerFault.exe
624	WerFault.exe
624	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
624	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	624	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 624	1660	f2b12cdd331f320e87f4dfc712740eec.exe	28
PID 1660 wrote to memory of 624	1660	f2b12cdd331f320e87f4dfc712740eec.exe	28
PID 1660 wrote to memory of 624	1660	f2b12cdd331f320e87f4dfc712740eec.exe	28
PID 1660 wrote to memory of 624	1660	f2b12cdd331f320e87f4dfc712740eec.exe	28

C:\Users\Admin\AppData\Local\Temp\f2b12cdd331f320e87f4dfc712740eec.exe
"C:\Users\Admin\AppData\Local\Temp\f2b12cdd331f320e87f4dfc712740eec.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 440
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/624-60-0x0000000000380000-0x00000000003E0000-memory.dmp

Download

memory/1660-55-0x0000000075C21000-0x0000000075C23000-memory.dmp

Download

memory/1660-56-0x00000000001B0000-0x00000000001FF000-memory.dmp

Download

memory/1660-57-0x0000000000400000-0x0000000000491000-memory.dmp

Download

memory/1660-58-0x0000000000510000-0x000000000059F000-memory.dmp

Download