raccoon | 67a5471d59ca74d55eda2a899d27e0c650b4bd66747461f1bdda634dc96d0c18 | Triage

Analysis

max time kernel
110s
max time network
137s
platform
windows10_x64
resource
win10-en-20211014
submitted
09-11-2021 11:36

Sharing

Report Analysis Logs

General

Target

fa5e0b9dd2cd2684fb54cc7f39f229b6.exe
Size

538KB
MD5

fa5e0b9dd2cd2684fb54cc7f39f229b6
SHA1

9f36eb3d78929f1877f0e4f4b2fa74eb580bac17
SHA256

67a5471d59ca74d55eda2a899d27e0c650b4bd66747461f1bdda634dc96d0c18
SHA512

214c58640796c5680b5f5f956ea5d692749c7b604e20583ff7fa2e5fbcc1ec34b67ffc5faec2c4b89847f289ea04ec817a8bc6267c5110400face823dcc290ec

Score

10^/10

raccoon fcdc156d3872c18d25e3ee45499599b45e492a67 stealer

Malware Config

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

fcdc156d3872c18d25e3ee45499599b45e492a67

Attributes

url4cnc
http://178.23.190.57/rino115sipsip
http://91.219.236.162/rino115sipsip
http://185.163.47.176/rino115sipsip
http://193.38.54.238/rino115sipsip
http://74.119.192.122/rino115sipsip
http://91.219.236.240/rino115sipsip
https://t.me/rino115sipsip

rc4.plain

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1916 created 2756 1916 WerFault.exe fa5e0b9dd2cd2684fb54cc7f39f229b6.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1916 2756 WerFault.exe fa5e0b9dd2cd2684fb54cc7f39f229b6.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
1916	WerFault.exe
1916	WerFault.exe
1916	WerFault.exe
1916	WerFault.exe
1916	WerFault.exe
1916	WerFault.exe
1916	WerFault.exe
1916	WerFault.exe
1916	WerFault.exe
1916	WerFault.exe
1916	WerFault.exe
1916	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1916 WerFault.exe
Token: SeBackupPrivilege 1916 WerFault.exe
Token: SeDebugPrivilege 1916 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fa5e0b9dd2cd2684fb54cc7f39f229b6.exe
"C:\Users\Admin\AppData\Local\Temp\fa5e0b9dd2cd2684fb54cc7f39f229b6.exe"
1⤵
PID:2756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 844
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2756-115-0x0000000002E19000-0x0000000002E68000-memory.dmp

Filesize
316KB

Download
memory/2756-116-0x00000000047A0000-0x000000000482F000-memory.dmp

Filesize
572KB

Download
memory/2756-117-0x0000000000400000-0x0000000002B7F000-memory.dmp

Filesize
39.5MB

Download