raccoon | 9598ecb2f430ae57baec3e652df255e48ab6fbc4cb680f567a5ba3832cae7e56

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-en-20211104
submitted
13/11/2021, 23:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d5bcb713701ff4284dfc09017147b6b4.exe
Size 567KB
Sample211113-3svm6acfbl
SHA256 9598ecb2f430ae57baec3e652df255e48ab6fbc4cb680f567a5ba3832cae7e56
MD5 d5bcb713701ff4284dfc09017147b6b4
SHA1 1f9d66acffa03cd2706305095afc3642eca76466
SHA512 6a612dd5f73e4fdea3fa5769c0436ae7df8f4ba20675658a090294aacbfddf366a16bbb8e38f594755329001c20a534d94c601981641d751a4eaced445a95bb7
MD5 SHA1 SHA512

Score

10^/10

raccoon 675718a5f2ce6d3cacf6cb04a512f5637eae995f stealer

Malware Config

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

675718a5f2ce6d3cacf6cb04a512f5637eae995f

Attributes

url4cnc
http://91.219.236.27/agrybirdsgamerept

http://5.181.156.92/agrybirdsgamerept

http://91.219.236.207/agrybirdsgamerept

http://185.225.19.18/agrybirdsgamerept

http://91.219.237.227/agrybirdsgamerept

http://185.163.47.176/agrybirdsgamerept

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Program crash 1 IoCs

pid	pid_target	Process	procid_target
576	1452	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
576	WerFault.exe
576	WerFault.exe
576	WerFault.exe
576	WerFault.exe
576	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
576	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	576	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 576	1452	d5bcb713701ff4284dfc09017147b6b4.exe	28
PID 1452 wrote to memory of 576	1452	d5bcb713701ff4284dfc09017147b6b4.exe	28
PID 1452 wrote to memory of 576	1452	d5bcb713701ff4284dfc09017147b6b4.exe	28
PID 1452 wrote to memory of 576	1452	d5bcb713701ff4284dfc09017147b6b4.exe	28

C:\Users\Admin\AppData\Local\Temp\d5bcb713701ff4284dfc09017147b6b4.exe
"C:\Users\Admin\AppData\Local\Temp\d5bcb713701ff4284dfc09017147b6b4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 408
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/576-60-0x0000000000320000-0x0000000000321000-memory.dmp

Download

memory/1452-55-0x00000000002CB000-0x000000000031B000-memory.dmp

Download

memory/1452-56-0x0000000075971000-0x0000000075973000-memory.dmp

Download

memory/1452-57-0x0000000002830000-0x00000000028BF000-memory.dmp

Download

memory/1452-58-0x0000000000400000-0x00000000027B5000-memory.dmp

Download