raccoon | 1abda6533abb0bc7d91351e49a8033d50748f82c58b2ee7e5c249432a60cd4d3 | Triage

Analysis

max time kernel
110s
max time network
124s
platform
windows10_x64
resource
win10-en-20211104
submitted
14-11-2021 06:07

Sharing

Report Analysis Logs

General

Target

3e2248e6b8b4056a604432a1b3d57d5b.exe
Size

448KB
MD5

3e2248e6b8b4056a604432a1b3d57d5b
SHA1

353e1f4a0cf1bfd54bcaf56b4806b275f12b7efc
SHA256

1abda6533abb0bc7d91351e49a8033d50748f82c58b2ee7e5c249432a60cd4d3
SHA512

da82093b6397ca8c3b690be64437a8f1ce1f7608fdbba3511c33b57fb1795c932da77bc3070c5dfda3c155ab4877b9350449b2edfc47e8d452a9150df4cb294b

Score

10^/10

raccoon 675718a5f2ce6d3cacf6cb04a512f5637eae995f stealer

Malware Config

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

675718a5f2ce6d3cacf6cb04a512f5637eae995f

Attributes

url4cnc
http://91.219.236.27/agrybirdsgamerept
http://5.181.156.92/agrybirdsgamerept
http://91.219.236.207/agrybirdsgamerept
http://185.225.19.18/agrybirdsgamerept
http://91.219.237.227/agrybirdsgamerept
http://185.163.47.176/agrybirdsgamerept

rc4.plain

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 4028 created 2568 4028 WerFault.exe 3e2248e6b8b4056a604432a1b3d57d5b.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4028 2568 WerFault.exe 3e2248e6b8b4056a604432a1b3d57d5b.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 4028 WerFault.exe
Token: SeBackupPrivilege 4028 WerFault.exe
Token: SeDebugPrivilege 4028 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3e2248e6b8b4056a604432a1b3d57d5b.exe
"C:\Users\Admin\AppData\Local\Temp\3e2248e6b8b4056a604432a1b3d57d5b.exe"
1⤵
PID:2568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 896
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2568-118-0x0000000002210000-0x000000000225F000-memory.dmp

Filesize
316KB

Download
memory/2568-119-0x00000000022F0000-0x000000000237F000-memory.dmp

Filesize
572KB

Download
memory/2568-120-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download