raccoon | b91c2f43aabab59c3df28395ced9cb1a35bd914c053381ff2f9a9b48c56558a3

Analysis

max time kernel
124s
max time network
120s
platform
windows7_x64
resource
win7-en-20211014
submitted
09/11/2021, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7dfa74fc58fc4dc09ad0af74083fe973.exe
Size 537KB
Sample211109-lrmsgsehc7
SHA256 b91c2f43aabab59c3df28395ced9cb1a35bd914c053381ff2f9a9b48c56558a3
MD5 7dfa74fc58fc4dc09ad0af74083fe973
SHA1 b574df15fe674e14c3a9c8975cf2092405e32f9a
SHA512 0ce08ef7e44c302033537ae98fbe633dfb05735bccea6e8aca065c46e44c4237f547a4e350c21e6cb1e0b9ad8c01a364991ed9d9b0ab44d74cc019780e6e1304
MD5 SHA1 SHA512

Score

10^/10

raccoon d4d445f09abd00ad30681d6fb869e8ac910a67e2 stealer

Malware Config

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

d4d445f09abd00ad30681d6fb869e8ac910a67e2

Attributes

url4cnc
http://178.23.190.57/jdiamond13

http://91.219.236.162/jdiamond13

http://185.163.47.176/jdiamond13

http://193.38.54.238/jdiamond13

http://74.119.192.122/jdiamond13

http://91.219.236.240/jdiamond13

https://t.me/jdiamond13

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1508	1524	WerFault.exe	14

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1508	WerFault.exe
1508	WerFault.exe
1508	WerFault.exe
1508	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1508	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1508	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 1508	1524	7dfa74fc58fc4dc09ad0af74083fe973.exe	28
PID 1524 wrote to memory of 1508	1524	7dfa74fc58fc4dc09ad0af74083fe973.exe	28
PID 1524 wrote to memory of 1508	1524	7dfa74fc58fc4dc09ad0af74083fe973.exe	28
PID 1524 wrote to memory of 1508	1524	7dfa74fc58fc4dc09ad0af74083fe973.exe	28

C:\Users\Admin\AppData\Local\Temp\7dfa74fc58fc4dc09ad0af74083fe973.exe
"C:\Users\Admin\AppData\Local\Temp\7dfa74fc58fc4dc09ad0af74083fe973.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 444
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1508-60-0x00000000003E0000-0x00000000003E1000-memory.dmp

Download

memory/1524-55-0x0000000002D6D000-0x0000000002DBC000-memory.dmp

Download

memory/1524-56-0x0000000076531000-0x0000000076533000-memory.dmp

Download

memory/1524-57-0x0000000000270000-0x00000000002FF000-memory.dmp

Download

memory/1524-58-0x0000000000400000-0x0000000002B7F000-memory.dmp

Download