raccoon | fdd4f5811b2ddef82ef643bbad923e615838947ecd447a4ad08b13f675b05c40

Analysis

max time kernel
125s
max time network
122s
platform
windows7_x64
resource
win7-en-20211104
submitted
13/11/2021, 19:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2901ef7ac9e8cc28cee1ddfb22462160.exe
Size 593KB
Sample211113-x2nnbafdd5
SHA256 fdd4f5811b2ddef82ef643bbad923e615838947ecd447a4ad08b13f675b05c40
MD5 2901ef7ac9e8cc28cee1ddfb22462160
SHA1 c41dd4c5407c0fd50971d0e4a2db37c1e80fe8ab
SHA512 d43255fcf4a31efb0e7408137f3a2eecd782a9113c29359589f5a8eeba27257f21ddc5867c3bb89b7e8717e9c880c769323d0db95aacf2be7ece8ff0858afab3
MD5 SHA1 SHA512

Score

10^/10

raccoon 675718a5f2ce6d3cacf6cb04a512f5637eae995f stealer

Malware Config

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

675718a5f2ce6d3cacf6cb04a512f5637eae995f

Attributes

url4cnc
http://91.219.236.27/agrybirdsgamerept

http://5.181.156.92/agrybirdsgamerept

http://91.219.236.207/agrybirdsgamerept

http://185.225.19.18/agrybirdsgamerept

http://91.219.237.227/agrybirdsgamerept

http://185.163.47.176/agrybirdsgamerept

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1388	572	WerFault.exe	12

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1388	WerFault.exe
1388	WerFault.exe
1388	WerFault.exe
1388	WerFault.exe
1388	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1388	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1388	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 572 wrote to memory of 1388	572	2901ef7ac9e8cc28cee1ddfb22462160.exe	28
PID 572 wrote to memory of 1388	572	2901ef7ac9e8cc28cee1ddfb22462160.exe	28
PID 572 wrote to memory of 1388	572	2901ef7ac9e8cc28cee1ddfb22462160.exe	28
PID 572 wrote to memory of 1388	572	2901ef7ac9e8cc28cee1ddfb22462160.exe	28

C:\Users\Admin\AppData\Local\Temp\2901ef7ac9e8cc28cee1ddfb22462160.exe
"C:\Users\Admin\AppData\Local\Temp\2901ef7ac9e8cc28cee1ddfb22462160.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 412
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/572-55-0x0000000002D2B000-0x0000000002D7A000-memory.dmp

Download

memory/572-56-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Download

memory/572-57-0x00000000002A0000-0x000000000032F000-memory.dmp

Download

memory/572-58-0x0000000000400000-0x0000000002B8D000-memory.dmp

Download

memory/1388-60-0x0000000000390000-0x0000000000391000-memory.dmp

Download