raccoon | cb2b0593dd5917cd2c733aec233994622c4eefc4876f5f3e4c90a241714766d3

Analysis

max time kernel
130s
max time network
120s
platform
windows7_x64
resource
win7-en-20211104
submitted
09/11/2021, 09:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
833b3ec3d707dadf9a80c781de0b245d.exe
Size 495KB
Sample211109-lvg2eaehd4
SHA256 cb2b0593dd5917cd2c733aec233994622c4eefc4876f5f3e4c90a241714766d3
MD5 833b3ec3d707dadf9a80c781de0b245d
SHA1 8245272e4d60a03b4ab2fc38ce61e16391df1f54
SHA512 88e94d3e0413d57b808e06dc90aa68989d8c41b2401766caf9d5212f02e69a3873ca673d087f2ba90d3569cb7ba5cbc7a2bcfa529b32a4da4e35d3489832c088
MD5 SHA1 SHA512

Score

10^/10

raccoon fcdc156d3872c18d25e3ee45499599b45e492a67 stealer

Malware Config

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

fcdc156d3872c18d25e3ee45499599b45e492a67

Attributes

url4cnc
http://178.23.190.57/rino115sipsip

http://91.219.236.162/rino115sipsip

http://185.163.47.176/rino115sipsip

http://193.38.54.238/rino115sipsip

http://74.119.192.122/rino115sipsip

http://91.219.236.240/rino115sipsip

https://t.me/rino115sipsip

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1476	2032	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1476	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1476	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1476	2032	833b3ec3d707dadf9a80c781de0b245d.exe	28
PID 2032 wrote to memory of 1476	2032	833b3ec3d707dadf9a80c781de0b245d.exe	28
PID 2032 wrote to memory of 1476	2032	833b3ec3d707dadf9a80c781de0b245d.exe	28
PID 2032 wrote to memory of 1476	2032	833b3ec3d707dadf9a80c781de0b245d.exe	28

C:\Users\Admin\AppData\Local\Temp\833b3ec3d707dadf9a80c781de0b245d.exe
"C:\Users\Admin\AppData\Local\Temp\833b3ec3d707dadf9a80c781de0b245d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 440
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1476-60-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/2032-55-0x0000000000A5D000-0x0000000000AAD000-memory.dmp

Download

memory/2032-56-0x0000000075881000-0x0000000075883000-memory.dmp

Download

memory/2032-57-0x0000000000240000-0x00000000002CF000-memory.dmp

Download

memory/2032-58-0x0000000000400000-0x000000000091F000-memory.dmp

Download