raccoon | 08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16

General

Target

08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe
Size

1.6MB
MD5

757e1e334fe85eee689578d50026342e
SHA1

0bbb20de6c3fb428473d2c94bf4993695de77b54
SHA256

08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16
SHA512

3e4b19dbc28abebdc1d0a220ddbfe895e27c673a0b81d19f725fb13fad540bec4c3bbfa6541a6b84dd7771da4c94c110b71e704868ffd8aece0c799efa52258c

Score

10^/10

raccoon b92a235bffa69e2c5cbe1e5e08c8f58c785cae24 stealer

Malware Config

Extracted

Family

raccoon

Botnet

b92a235bffa69e2c5cbe1e5e08c8f58c785cae24

Attributes

url4cnc
https://telete.in/jrubixred

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1272-64-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral1/memory/1272-66-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral1/memory/1272-68-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral1/memory/1272-69-0x0000000000440131-mapping.dmp	family_raccoon
behavioral1/memory/1272-72-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral1/memory/1272-73-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon

Suspicious use of SetThreadContext 1 IoCs

Processes:

08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe

description	pid	process	target process
PID 1928 set thread context of 1272	1928	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe

pid process

1928 08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe

description pid process

Token: SeDebugPrivilege 1928 08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe

pid	process
1928	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe

description	pid	process
Token: SeDebugPrivilege	1928	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe

description	pid	process	target process
PID 1928 wrote to memory of 1236	1928	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe
PID 1928 wrote to memory of 1236	1928	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe
PID 1928 wrote to memory of 1236	1928	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe
PID 1928 wrote to memory of 1236	1928	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe
PID 1928 wrote to memory of 1272	1928	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe
PID 1928 wrote to memory of 1272	1928	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe
PID 1928 wrote to memory of 1272	1928	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe
PID 1928 wrote to memory of 1272	1928	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe
PID 1928 wrote to memory of 1272	1928	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe
PID 1928 wrote to memory of 1272	1928	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe
PID 1928 wrote to memory of 1272	1928	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe
PID 1928 wrote to memory of 1272	1928	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe
PID 1928 wrote to memory of 1272	1928	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe
PID 1928 wrote to memory of 1272	1928	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe	08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe

C:\Users\Admin\AppData\Local\Temp\08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe
"C:\Users\Admin\AppData\Local\Temp\08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928

C:\Users\Admin\AppData\Local\Temp\08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe
"C:\Users\Admin\AppData\Local\Temp\08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe"
2⤵
PID:1236

C:\Users\Admin\AppData\Local\Temp\08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe
"C:\Users\Admin\AppData\Local\Temp\08652b211275d1522371646b2934547200200f7e2d8983afc645011daab4ff16.exe"
2⤵
PID:1272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-66-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1272-64-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1272-73-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1272-72-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1272-69-0x0000000000440131-mapping.dmp

Download
memory/1272-59-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1272-62-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1272-60-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1272-68-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1928-54-0x0000000000960000-0x0000000000AA8000-memory.dmp

Filesize
1.3MB

Download
memory/1928-55-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download
memory/1928-58-0x0000000005250000-0x00000000052E8000-memory.dmp

Filesize
608KB

Download
memory/1928-57-0x0000000005190000-0x0000000005248000-memory.dmp

Filesize
736KB

Download
memory/1928-56-0x00000000003F0000-0x00000000003F8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads