raccoon | 97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
23/02/2022, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
Size 629KB
Sample220223-xmx87scdgm
SHA256 97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293
MD5 f7ba0f7a61b8b51a5e1823d5fd274d12
SHA1 64b9713a552f1efb9865782c5eb181e4bf6a392c
SHA512 029501cd62f5884a39013dc4515022747f8e40721490086d2d898e6ee257950b75fce19c0126236aaf46ff4268299cdd74ad7d0515484999a422817b76cf8ba8
MD5 SHA1 SHA512

Score

10^/10

raccoon e1705ddaac9f73881d2b3657a93827c883eac34f stealer

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

e1705ddaac9f73881d2b3657a93827c883eac34f

Attributes

url4cnc
https://telete.in/uidesopencardtop

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 2 IoCs

resource	yara_rule
behavioral2/memory/4520-135-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon
behavioral2/memory/4520-136-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1140 set thread context of 4520	1140	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	92

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1140	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 4520	1140	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	92
PID 1140 wrote to memory of 4520	1140	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	92
PID 1140 wrote to memory of 4520	1140	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	92
PID 1140 wrote to memory of 4520	1140	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	92
PID 1140 wrote to memory of 4520	1140	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	92
PID 1140 wrote to memory of 4520	1140	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	92
PID 1140 wrote to memory of 4520	1140	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	92
PID 1140 wrote to memory of 4520	1140	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	92
PID 1140 wrote to memory of 4520	1140	97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe	92

C:\Users\Admin\AppData\Local\Temp\97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
"C:\Users\Admin\AppData\Local\Temp\97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Users\Admin\AppData\Local\Temp\97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
  C:\Users\Admin\AppData\Local\Temp\97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293.exe
  2⤵
  PID:4520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1140-130-0x0000000000ED0000-0x0000000000F70000-memory.dmp

Download

memory/1140-131-0x00000000058B0000-0x0000000005926000-memory.dmp

Download

memory/1140-133-0x0000000005A10000-0x0000000005A11000-memory.dmp

Download

memory/1140-132-0x0000000074E4E000-0x0000000074E4F000-memory.dmp

Download

memory/1140-134-0x0000000003420000-0x000000000343E000-memory.dmp

Download

memory/4520-135-0x0000000000400000-0x0000000000495000-memory.dmp

Download

memory/4520-136-0x0000000000400000-0x0000000000495000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads