raccoon | 97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293

General

Target

97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
Size

629KB
MD5

f7ba0f7a61b8b51a5e1823d5fd274d12
SHA1

64b9713a552f1efb9865782c5eb181e4bf6a392c
SHA256

97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293
SHA512

029501cd62f5884a39013dc4515022747f8e40721490086d2d898e6ee257950b75fce19c0126236aaf46ff4268299cdd74ad7d0515484999a422817b76cf8ba8

Score

10^/10

raccoon e1705ddaac9f73881d2b3657a93827c883eac34f stealer

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

e1705ddaac9f73881d2b3657a93827c883eac34f

Attributes

url4cnc
https://telete.in/uidesopencardtop

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/432-58-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon
behavioral1/memory/432-60-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon

Suspicious use of SetThreadContext 1 IoCs

Processes:

97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe

description	pid	process	target process
PID 1264 set thread context of 432	1264	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe

description pid process

Token: SeDebugPrivilege 1264 97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe

description	pid	process
Token: SeDebugPrivilege	1264	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe

description	pid	process	target process
PID 1264 wrote to memory of 432	1264	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
PID 1264 wrote to memory of 432	1264	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
PID 1264 wrote to memory of 432	1264	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
PID 1264 wrote to memory of 432	1264	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
PID 1264 wrote to memory of 432	1264	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
PID 1264 wrote to memory of 432	1264	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
PID 1264 wrote to memory of 432	1264	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
PID 1264 wrote to memory of 432	1264	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
PID 1264 wrote to memory of 432	1264	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
PID 1264 wrote to memory of 432	1264	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe

C:\Users\Admin\AppData\Local\Temp\97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
"C:\Users\Admin\AppData\Local\Temp\97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1264

C:\Users\Admin\AppData\Local\Temp\97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
C:\Users\Admin\AppData\Local\Temp\97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
2⤵
PID:432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/432-58-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/432-59-0x0000000075191000-0x0000000075193000-memory.dmp

Filesize
8KB

Download
memory/432-60-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/1264-54-0x0000000073DAE000-0x0000000073DAF000-memory.dmp

Filesize
4KB

Download
memory/1264-55-0x0000000000D30000-0x0000000000DD0000-memory.dmp

Filesize
640KB

Download
memory/1264-56-0x0000000004870000-0x0000000004871000-memory.dmp

Filesize
4KB

Download
memory/1264-57-0x00000000003C0000-0x00000000003D4000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads