raccoon | 97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293

General

Target

97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
Size

629KB
MD5

f7ba0f7a61b8b51a5e1823d5fd274d12
SHA1

64b9713a552f1efb9865782c5eb181e4bf6a392c
SHA256

97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293
SHA512

029501cd62f5884a39013dc4515022747f8e40721490086d2d898e6ee257950b75fce19c0126236aaf46ff4268299cdd74ad7d0515484999a422817b76cf8ba8

Score

10^/10

raccoon e1705ddaac9f73881d2b3657a93827c883eac34f stealer

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

e1705ddaac9f73881d2b3657a93827c883eac34f

Attributes

url4cnc
https://telete.in/uidesopencardtop

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4520-135-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon
behavioral2/memory/4520-136-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon

Suspicious use of SetThreadContext 1 IoCs

Processes:

97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe

description	pid	process	target process
PID 1140 set thread context of 4520	1140	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe

description pid process

Token: SeDebugPrivilege 1140 97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe

description	pid	process
Token: SeDebugPrivilege	1140	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe

description	pid	process	target process
PID 1140 wrote to memory of 4520	1140	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
PID 1140 wrote to memory of 4520	1140	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
PID 1140 wrote to memory of 4520	1140	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
PID 1140 wrote to memory of 4520	1140	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
PID 1140 wrote to memory of 4520	1140	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
PID 1140 wrote to memory of 4520	1140	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
PID 1140 wrote to memory of 4520	1140	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
PID 1140 wrote to memory of 4520	1140	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
PID 1140 wrote to memory of 4520	1140	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe

C:\Users\Admin\AppData\Local\Temp\97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
"C:\Users\Admin\AppData\Local\Temp\97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140

C:\Users\Admin\AppData\Local\Temp\97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
C:\Users\Admin\AppData\Local\Temp\97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
2⤵
PID:4520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1140-130-0x0000000000ED0000-0x0000000000F70000-memory.dmp

Filesize
640KB

Download
memory/1140-131-0x00000000058B0000-0x0000000005926000-memory.dmp

Filesize
472KB

Download
memory/1140-133-0x0000000005A10000-0x0000000005A11000-memory.dmp

Filesize
4KB

Download
memory/1140-132-0x0000000074E4E000-0x0000000074E4F000-memory.dmp

Filesize
4KB

Download
memory/1140-134-0x0000000003420000-0x000000000343E000-memory.dmp

Filesize
120KB

Download
memory/4520-135-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/4520-136-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads