raccoon | 429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035

General

Target

429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe
Size

1.9MB
MD5

dd0146c74694b0d0a32bab320a8a9ee5
SHA1

e706f8d4f153b5c60e502f947bded7950f19a901
SHA256

429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035
SHA512

72bb8daa6eec9edb871dc515049e82851aec29e8d0828093a214a893e210342d5b66b5bed2ee9c27b5463ad5b29df2639078f42a44357ffd5c62cc10b951b1b1

Score

10^/10

raccoon c763e433ef51ff4b6c545800e4ba3b3b1a2ea077 stealer

Malware Config

Extracted

Family

raccoon

Botnet

c763e433ef51ff4b6c545800e4ba3b3b1a2ea077

Attributes

url4cnc
https://telete.in/jbitchsucks

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2028-65-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral1/memory/2028-67-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral1/memory/2028-69-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral1/memory/2028-70-0x000000000043FCC3-mapping.dmp	family_raccoon
behavioral1/memory/2028-73-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral1/memory/2028-74-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon

Loads dropped DLL 1 IoCs

Processes:

429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe

pid process

1796 429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe

pid	process
1796	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe

description	pid	process	target process
PID 1796 set thread context of 2028	1796	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe

pid process

1796 429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe

description pid process

Token: SeDebugPrivilege 1796 429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe

pid	process
1796	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe

description	pid	process
Token: SeDebugPrivilege	1796	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe

description	pid	process	target process
PID 1796 wrote to memory of 2028	1796	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe
PID 1796 wrote to memory of 2028	1796	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe
PID 1796 wrote to memory of 2028	1796	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe
PID 1796 wrote to memory of 2028	1796	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe
PID 1796 wrote to memory of 2028	1796	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe
PID 1796 wrote to memory of 2028	1796	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe
PID 1796 wrote to memory of 2028	1796	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe
PID 1796 wrote to memory of 2028	1796	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe
PID 1796 wrote to memory of 2028	1796	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe
PID 1796 wrote to memory of 2028	1796	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe

C:\Users\Admin\AppData\Local\Temp\429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe
"C:\Users\Admin\AppData\Local\Temp\429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1796

C:\Users\Admin\AppData\Local\Temp\429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe
"C:\Users\Admin\AppData\Local\Temp\429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe"
2⤵
PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\4acacee3-cefe-4dab-b6f1-01f9a63ec79a\e.dll
Filesize
94KB

MD5
14ff402962ad21b78ae0b4c43cd1f194

SHA1
f8a510eb26666e875a5bdd1cadad40602763ad72

SHA256
fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

SHA512
daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

Download Submit
memory/1796-54-0x0000000001290000-0x0000000001470000-memory.dmp

Filesize
1.9MB

Download
memory/1796-55-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1796-56-0x00000000005E0000-0x000000000060C000-memory.dmp

Filesize
176KB

Download
memory/1796-59-0x00000000006A0000-0x00000000006AC000-memory.dmp

Filesize
48KB

Download
memory/2028-61-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2028-60-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2028-63-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2028-65-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2028-67-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2028-69-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2028-70-0x000000000043FCC3-mapping.dmp

Download
memory/2028-73-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2028-74-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads