raccoon | 9b6b3e2da4b70153ce7d7eec15834670a70a71e359f590ccdb3cef331e86a165

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
16/03/2022, 04:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c0270505461a49d4a97ef199d64335da.exe
Size 4.3MB
Sample220316-fbpn9affgp
SHA256 9b6b3e2da4b70153ce7d7eec15834670a70a71e359f590ccdb3cef331e86a165
MD5 c0270505461a49d4a97ef199d64335da
SHA1 cbe0ffd88ef85017a9d6ec8ec3ba712184231a00
SHA512 a06ad1b980a9e406c0be68c5a838d713da8f69ea596cc622bf2fbf94acf98eec25b442e1cd97ba4f2d539ae9269477f0620fa6be908271c7a836153831085c0e
MD5 SHA1 SHA512

Score

10^/10

raccoon 4bf1e12c41a2488f19dece6d08f2bfade15a9ace stealer suricata

Malware Config

Extracted

Family

raccoon

Botnet

4bf1e12c41a2488f19dece6d08f2bfade15a9ace

Attributes

url4cnc
http://185.163.204.81/l99stnull

http://194.180.191.33/l99stnull

http://174.138.11.98/l99stnull

http://194.180.191.44/l99stnull

http://91.219.236.120/l99stnull

https://t.me/l99stnull

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)
suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)
suricata

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1032 set thread context of 2768	1032	c0270505461a49d4a97ef199d64335da.exe	80

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 2768	1032	c0270505461a49d4a97ef199d64335da.exe	80
PID 1032 wrote to memory of 2768	1032	c0270505461a49d4a97ef199d64335da.exe	80
PID 1032 wrote to memory of 2768	1032	c0270505461a49d4a97ef199d64335da.exe	80
PID 1032 wrote to memory of 2768	1032	c0270505461a49d4a97ef199d64335da.exe	80
PID 1032 wrote to memory of 2768	1032	c0270505461a49d4a97ef199d64335da.exe	80

C:\Users\Admin\AppData\Local\Temp\c0270505461a49d4a97ef199d64335da.exe
"C:\Users\Admin\AppData\Local\Temp\c0270505461a49d4a97ef199d64335da.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1032-130-0x0000000000D80000-0x00000000017D2000-memory.dmp

Download

memory/2768-134-0x0000000000400000-0x0000000000493000-memory.dmp

Download

memory/2768-140-0x0000000000400000-0x0000000000493000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads