raccoon | 65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d

General

Target

65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe
Size

33KB
MD5

dc14553bed2ff0c430fe14d03b904142
SHA1

32ddd246599f8715ac34cc167fa8f210b4e7c7f9
SHA256

65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d
SHA512

69deb6c3a3a2d5a889e16cfd0a282df279ea0b8f46bd880dff392aefee437842fedce8b1330de81fad4aaa73d0c1e2237f0520a66ca3fe741c714e5715bc8b21

Score

10^/10

raccoon agilenet stealer

Malware Config

Extracted

Family

raccoon

Version

1.8.4-hotfixs

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1116 created 4032 1116 WerFault.exe 65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe

description	pid	process	target process
PID 1116 created 4032	1116	WerFault.exe	65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe

Obfuscated with Agile.Net obfuscator 2 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/2800-115-0x0000000000550000-0x000000000055E000-memory.dmp	agile_net
behavioral1/memory/2800-116-0x0000000000550000-0x000000000055E000-memory.dmp	agile_net

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

Processes:

65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe

description	pid	process	target process
PID 2800 set thread context of 4032	2800	65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe	65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1116 4032 WerFault.exe 65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe

pid	pid_target	process	target process
1116	4032	WerFault.exe	65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exeWerFault.exe

pid	process
2800	65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe
2800	65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe
1116	WerFault.exe
1116	WerFault.exe
1116	WerFault.exe
1116	WerFault.exe
1116	WerFault.exe
1116	WerFault.exe
1116	WerFault.exe
1116	WerFault.exe
1116	WerFault.exe
1116	WerFault.exe
1116	WerFault.exe
1116	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	2800	65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe
Token: SeRestorePrivilege	1116	WerFault.exe
Token: SeBackupPrivilege	1116	WerFault.exe
Token: SeDebugPrivilege	1116	WerFault.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe

description	pid	process	target process
PID 2800 wrote to memory of 4032	2800	65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe	65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe
PID 2800 wrote to memory of 4032	2800	65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe	65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe
PID 2800 wrote to memory of 4032	2800	65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe	65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe
PID 2800 wrote to memory of 4032	2800	65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe	65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe
PID 2800 wrote to memory of 4032	2800	65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe	65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe
PID 2800 wrote to memory of 4032	2800	65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe	65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe
PID 2800 wrote to memory of 4032	2800	65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe	65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe
PID 2800 wrote to memory of 4032	2800	65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe	65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe
PID 2800 wrote to memory of 4032	2800	65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe	65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe

C:\Users\Admin\AppData\Local\Temp\65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe
"C:\Users\Admin\AppData\Local\Temp\65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800

C:\Users\Admin\AppData\Local\Temp\65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe
C:\Users\Admin\AppData\Local\Temp\65e2e0704a22d1a0f3d5453c2e9ac551a839af68415958ef0c03e44d1a82829d.exe
2⤵
PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 864
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1116

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2800-115-0x0000000000550000-0x000000000055E000-memory.dmp

Filesize
56KB

Download
memory/2800-116-0x0000000000550000-0x000000000055E000-memory.dmp

Filesize
56KB

Download
memory/2800-117-0x0000000005020000-0x0000000005021000-memory.dmp

Filesize
4KB

Download
memory/2800-118-0x00000000057F0000-0x00000000058A8000-memory.dmp

Filesize
736KB

Download
memory/2800-119-0x0000000005AB0000-0x0000000005AFC000-memory.dmp

Filesize
304KB

Download
memory/2800-120-0x0000000005BC0000-0x0000000005C52000-memory.dmp

Filesize
584KB

Download
memory/4032-121-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/4032-122-0x0000000000440309-mapping.dmp

Download
memory/4032-123-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads