raccoon | 5e2c211900e145c9aad6d6970858eebbadf07ea9cfb517deae7e5edc66e41cb4

General

Target
e76a72943fd90042a8e1e3df2b5d4280.exe
Size 552KB
Sample220315-rtknssbaal
SHA256 5e2c211900e145c9aad6d6970858eebbadf07ea9cfb517deae7e5edc66e41cb4
MD5 e76a72943fd90042a8e1e3df2b5d4280
SHA1 724382a0fd9cc3e6bbb2eb6dbae2dbe57d223cad
SHA512 5418b5d3860cd23f0739c40add74d21136d8f6123418bef94c6ffa29fbc42f98a0c54656e55f10a4c9869bc12b5ca0a63f4eb4de41f388857e81afaf5c8f1fe2
MD5 SHA1 SHA512

Score

10^/10

raccoon d7ce4d2837ba5349afb5f48e90638edf69cc105c stealer suricata

Malware Config

Extracted

Family

raccoon

Botnet

d7ce4d2837ba5349afb5f48e90638edf69cc105c

Attributes

url4cnc
http://185.163.204.81/hkpyagain

http://194.180.191.33/hkpyagain

http://174.138.11.98/hkpyagain

http://194.180.191.44/hkpyagain

http://91.219.236.120/sheinl

https://t.me/hkpyagain

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)
suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)
suricata

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4716	2420	WerFault.exe	31

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e0000000002000000000010660000000100002000000089ae1f1bd833b4b138feb4df0c639ea2f05bf967a8213b5dbc469941f88b8b48000000000e80000000020000200000001d523afd0f3bfc290d2a1264df56417002266ed9f47a403aca6786a84b4eed4a100d0000a0e89c36fcf81b27c47d1646ca2f1d021a9f5c3a94735c32e0338b77f7e5de1df28ca3d29a3dab9413bb1c3b09bbf383b874062d6ee1bbfd474dceef541bad0bda96008cf897c0c6f3de5b13eb6e1bba1f56ff3c0d85c1fdb344fdc8434f571db73ef5e279410f47287c9b5babd0659b980215f19e6288b07125b4d3b376e8faf9cb40710dd64ff704c6de962e9c1ce4bd4031d2a001b0eb63cd20a01897e7850605cc942d1bce4801ddcfa30b8acd92a2f59491e872718f5f4787f141c9b614d90bc584b80e92c8555c23d318cf350207efb08fba390bc813d15de5e2a21150701bf90edca0029f9068f51f96359509164ba6afc86000754938b198fedbf43aa06954d4892b40d78dc57d24046a498b852161de03b90172eae4eb2a36b1f9236cd9e57b50d86f07a1749cd94928731636546ba1729bbf4a0c6d3fb079e2f105bf950b19ea9e861af6b46309db9362b80923887aec4acd2bf4f6eb8e848dbd208aecc1aca960c992096cd00161ff6b981a339d43cc36427f20179c6dbb05e593a4d44397f9839265f901da7e8664694e186b0e82c5d742a275d9c94e96761393595b306f46c1e0ce4b43c038beb06353ed4e1ffa543826ef296a2ea58272fd6f49d41559e3fc86cdd460003d5305802a6a51a1b21a60d39ca3428a8541d64e753c1c69f2e730e807d493694850a12cb73ea4476ec31aa183ef4342b3758e21b5a332685533936d61d1568f8521867fb7d44b1e2bebb5351f7c4deb7b53038d6feb033ae9c689a589583bd3a2781885b03854dc9b27855c140ebea03639f5ba40970d85b0b96705934bd5266367e5f538ed69940e3fcccf940f658e662a91fbdcb5beaefc8a333af37ee15b4958550e56c8a7688a7bc32e4ec0923d43430b4488aa16868bb1341d303605fda581d362497a2d5033131f55a5a38fcbac52f892c24a783f8b0400066140a41127054cde83e0cd08c56706bd402bc53d4e20bfb254ee35a4becc6cd96d15a8edfce1b5ebca327a2c9c28d211b2058a15929f48940b8f06060f0b293704ce46db90a5769f97d2d113ea9eaafe0cdd3c6ceed3f0f607450ead0fd4bd48caee36c45970b81a9b80b7ef070a2656dc7be001b4c29f726fdb6eb5235ea77338314fa989a3a6f24f3dd6300f82bfada4a957d5f3b0196547af9f75f1a7eda96cdd120ee9ad38120273d8724f884e5dae12d2bb673139b8e7929360d5ea6d0613413b44ef19be8731e23f1c50734ecc9c8b3436f1b68d702d5018b07874206b957b5127117d67ccf928b134f17061ba9cf7aaa450862537bdabc9a9fc2baa532eb602d90c82d29087d9832a7de8db7130029e3f17963b06d2fc489a2523542930b3e531f5c7ea3b7040987c7afe00bc62e49eaeec658025a36238c8f5c0ef1229fb56604d9b3c586b60b310ed6c79887a83fb3b513bdba7c17b4f620ed6ad149201c51b099cfe7117a59aa02a70cec98631be1d7d8321dbdd51d6fffd4a455f3a2379f01f85fd920cfb3474499aa18b66954baa09464d068471d74beb1ac0fbd3e834af1e292d6061db5c5b0d91c82bf3b997e83bc98184e5431aa0f9cfe73a42231ebd7caff823c0d2279d15291783ed8acb151934af2a6f201e2c2d9ccb517fcdd0f8ed433686fd6c6b8e01071b07b970e91ce70bd87e69f895058c687c4c4ef6c66c7023dfd5c78e4b50b9159b39e66d6f069e2416e7652fdebaf49a690d84c981783879a798697009bfe8ffa50927c884e09c9e4a5d31e1047cd817c4d3a17890de9a12f5b6e4669ed8febd65bc4bd00956fcb7fd9b564eafefcf31a1d1f967688ad55168c32c693b38b834109c784b1543c4bca73b268a3fb52eb642fbd7895b0702411750c37b3f01bf705547a0b37970ad280438bdfb7b09de27a6d96a433f2cbd904cfacf1577e24010283531c10ed93c494ee7ff8cccf2565952d8b5f299ab79e9ce83f1baf109c087f7250bf2eaeae48e6564834b8d0ba2c79cc11e9e02e5f7c499c7a41a6eac80cc51c42191edc2e223ecea03881aa6a490b2d7b3a2cd2e7db1cd0bc99afe7a53b406f0b595efd875e314ef1ca653f56ca1218b7113147678094a562694ebb1c8ac1cb19e79a390327e6fe9f8030f7c2b8736273d88d9b481714564356393556a9f8000137ef85c0e3969dbad1153b988155c0aaacf2eb0c19759139fc964e7f0ca60e0af8f44d735ec116bdec5baa070f0eeb77225693d704fb6d1bd01e5f3588c3c4198c3b99b2cd13d93487a67caf5f30d002999ce0bc1ee5a56bef2897739812404dbcd76507a9330fb5231a29afaddbbbad84a5a177c2d4ba9c43eac3ea744cb282a15a67ed123a6d9930d0ad693c57a51cefc895d67fd7004ef64b2435eab72f971e698100622d273ef20ba02c1cf6268e95405081b439a265cd6a8218baa190dad9f3f6a377c6d2ed075d00ab34d40c1d70c90c9562f4fe96fe9ff6a24a9f67af55f252470dfe56b895000ee4006657b606df65cc5b139ec95b3b225c1d5f03d1f65d5a4b24362f01355882c7a38e1a8f116ffec898b180f6b45a73aa973c75e1d0fcc64881d5f1ee93c517b3af6574feb54f19433b3f746ad2137d456bd5f432d555d96719fe043423bd564753df1eb06f232b6ec49775cd84f1d8f4ea3cedaa157707c2c992335a579844cfef1b15e363a5aee951ce2a03980e26da43c8dc5e2de62815d6a357dd6725257025cd9aeb5e41a7af78c11bb39b1ba4224b5b759c61c08ff723c9a31a140c8a26da8db9534fcc4d373e5278b089040b534ff1a0f4830db2aa3b14a784822190ebe5eb00582fa08b540d0b7921ccd20c15e344d1b987213ae89507c863ec26aa13aa9a98b43945a61189648c53edf4365ff2fc24595a2f02319579c45781e466423c50d6526df98dc985c27a9b08e7f535d6664690e6e2e8c49ddf178b6ee4738ae7d436ecd1fd451011ef74edd81d4ea55442a5ba4123524dad25953148743590a9a7e950b5a4ba7f468df2a6ad42a6c45bf01055a9f654d0f08e3a4e919b243d45972d4b432431121ed7be0f6e7bcaf633045e4bf1f41b48a89b45eeb2d58920ce184502c55cd80edbeb9f6ce0fe92084e98b6557eac7fcbed03ffa4b47b2cac22469606b1b2b438ddc2663562731bdcff25f58dc21acb68ea163fcbdb4f816fbd83244d84a0c7d1aef99e28df4b88cabfee4ef6860d8221bfcc5a950d07898c1e2265c026b201b6969ce38528c975a19d3c9a4a21500c3029946aeba965ea819139fdcc5f89fbf138f4aefeca0a1718144fc4a2a1bed75eb36725d703202a6190e977a4fe182a1705b1ddf713eb47598eed1e82da7b228f52d6b47f835ee49f26d5fb6fa60060dac8117d19c1d71cd4bdbeec7d68a6ecc0b019a66df8ac52b0ba18b6a00133c04b0bb11e1e1e9ba9fca00fe5e402b5ff0248123addc84b637f110658ad76c8230c081f4b9988d0bf3aa014b1cdc33926157d78786fc593ebfe6ea2b24b4f69024e0ca8a0f034c11b257a8495b52d21d0fb0fc47a91e3e234b5ec806f51c6815d5cdda482f3201aa3832d6ffdc481a0a9a679fbf0700101c17058e5a0a22bb5b72cfd984c18ddf5f3d4d2328ab7e1f16ce4d418503b1e734832e0918a2a5944db136743e218aeff9239af5adc99ac2e31ad81615b4e6a7eef9d7864514232de3fdec9d3041539020f345cde0f8768ab85be8263a38d50ad51bd8025bf0236c4e1f6a6a15883dd895685175b7854fe2b1edc76c8eeec707ef4554774575aa33151e3128ca3f38053465de968e02c0ab565d932553dbfd6354d3fcd7adb0cbfe8fece35b849dfbd66cc6eea09b6f48fb83400b72fd4ac01a4a781ca4cf3d70f90aaa659dcc71e6bba14c25e553c277ef8eba5caa61ffd41aa374847825d35dd98c8efc938f2d8002252b026ceccaac9983f0bbd7684ceb987545222d0da2cc8825e367bcd4c4bf34c6ed56d94f7fadf0db0ef177cc2951c5fb11d3dc8303b2287fc8c0c670db9d89dc6e97893af30715fce54f8a7a7609281478cf8d3226c045ddea59527414917956a2f2984880796ddac2ec3af8ecddb089b6ac49659ace3caeae4cfdb886b697bf48929f8316a5091be8ddd3e4e4bb1d9066c96294b95a6488676285636c6d9feba68e4a9d80fb2a5493359e985cc39e073755c509b65bd3ac5a623153a9a3a892b00f7490e239536f0a0328ff96035b24c3ecbac06e6eccd576484787b38b10d4b9a9ba75d7e720c7180ee059f783bf55a916f2576660c0549320e068387812e3a62040936fb3cad5cacd13d29c539a58d27f724efb6ee3dc7a3a2d2c249b106f20bfb9f927b8fa73170abe7d0b9b0bcb4bdaf0a9de2c408932fac893e5b252f3985494ba4498b2d0b2c7c616a8fc1b1d2ecd05a00cb1dd3d7e309b821a9bd82f188c41f875a15e97668c42c7d2dcdc88b3510860c575ba352cd423990928ebcbc7690170eee5fa12d0416c8505c4b113477559b9933f34ad231c1cc1863e08a4077c4c49eb7053f06dd20d784c660506793bc8f0b0aa2a238fbad6fcbba8547695fbd39481eea32e2ea335e41ba840f1f05a2ad0db46148d7ccead538015f6e738e28ee98ff73e40fe67d9d99e65263bf50def7184e6aaf4a680962a7feaa29771a92a4d3458d294527d16d6ef0242c4ffdaa365fbfa0a06f933d941ae206b8c3fcc1faa57bc8290a567ae574061f2f02f06457ca2d77fca9e13fbf41a5840000000b1fd784008a2ad6c9bd2b7b4f8de241eff3e33820f19bc3e1540e6f1699b6fdebe8be9a3317c672ef1e07229e966c4ed4494280eae619436ba8667fa0f0181ba	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "00188006A52C1D95"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\00188006A52C1D95 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e0000000002000000000010660000000100002000000023eabf7ae5e1da693de5a5b8b416a99ba9a056096cd49756e4b884a02876e0e2000000000e8000000002000020000000816a5acde04026eaaeb70a6aa5963998f05066ab16f3e4c15dc05810772ad5e48000000006a98a2391fb12cdcd6d466a29e826e71108f21cbedfeaa32be4122b1f7f947951d679aebd7e8d0aaa476ebd715c901ed814b8109be8ecfde92e65016fe767b5dc30423f7ee43e7377ccf3a7b80f2676d6c2b568d2483e27021d71c068e75c3fbbab50828ee7e452ebccd6314e44c9676bab6b17edb97fb0c5ef10e2ad2c347c40000000ce3c31155064c9606d67f6b21812be757e86738cf2cb24b2c0b74b782b6ad7b58ef7bef746a80b77cba3bb707bf7a694e40b8eb1c6315062277d0818f5f7f66c	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}	svchost.exe

C:\Users\Admin\AppData\Local\Temp\e76a72943fd90042a8e1e3df2b5d4280.exe
"C:\Users\Admin\AppData\Local\Temp\e76a72943fd90042a8e1e3df2b5d4280.exe"
1⤵
PID:3488

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 448 -p 2420 -ip 2420
1⤵
PID:1528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
- Modifies data under HKEY_USERS
PID:4428

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2420 -s 2012
1⤵
- Program crash
PID:4716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3488-134-0x000000000076D000-0x00000000007BD000-memory.dmp

Download

memory/3488-135-0x000000000076D000-0x00000000007BD000-memory.dmp

Download

memory/3488-136-0x0000000000680000-0x0000000000712000-memory.dmp

Download

memory/3488-137-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads