raccoon | 879b3d8f4e4f90f19da28a6ff8b46fac43c972a2b4b268a708966650b9148b7f | Triage

Analysis

max time kernel
87s
max time network
130s
platform
windows10_x64
resource
win10-en-20211104
submitted
14-11-2021 08:22

Sharing

Report Analysis Logs

General

Target

100f06c3c5a50552ecfde1fbf3e9b4bb.exe
Size

500KB
MD5

100f06c3c5a50552ecfde1fbf3e9b4bb
SHA1

1749c9ac51e7d76c5138c7a8a4de13ce16e7423a
SHA256

879b3d8f4e4f90f19da28a6ff8b46fac43c972a2b4b268a708966650b9148b7f
SHA512

474dd5169b516f0dba5d15d6ab75ef2b1e45dec18b7958a020cbe4a98499f6d9e13879ffa37777cad11a0b4fa84dd960a4b452fe4b475a8967768e1b28bda32a

Score

10^/10

raccoon 675718a5f2ce6d3cacf6cb04a512f5637eae995f stealer

Malware Config

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

675718a5f2ce6d3cacf6cb04a512f5637eae995f

Attributes

url4cnc
http://91.219.236.27/agrybirdsgamerept
http://5.181.156.92/agrybirdsgamerept
http://91.219.236.207/agrybirdsgamerept
http://185.225.19.18/agrybirdsgamerept
http://91.219.237.227/agrybirdsgamerept
http://185.163.47.176/agrybirdsgamerept

rc4.plain

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 804 created 2452 804 WerFault.exe 100f06c3c5a50552ecfde1fbf3e9b4bb.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

804 2452 WerFault.exe 100f06c3c5a50552ecfde1fbf3e9b4bb.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 804 WerFault.exe
Token: SeBackupPrivilege 804 WerFault.exe
Token: SeDebugPrivilege 804 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\100f06c3c5a50552ecfde1fbf3e9b4bb.exe
"C:\Users\Admin\AppData\Local\Temp\100f06c3c5a50552ecfde1fbf3e9b4bb.exe"
1⤵
PID:2452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 896
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2452-118-0x00000000021C0000-0x000000000220F000-memory.dmp

Filesize
316KB

Download
memory/2452-119-0x0000000002230000-0x00000000022BF000-memory.dmp

Filesize
572KB

Download
memory/2452-120-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download