raccoon | 429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035

General

Target

429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe
Size

1.9MB
MD5

dd0146c74694b0d0a32bab320a8a9ee5
SHA1

e706f8d4f153b5c60e502f947bded7950f19a901
SHA256

429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035
SHA512

72bb8daa6eec9edb871dc515049e82851aec29e8d0828093a214a893e210342d5b66b5bed2ee9c27b5463ad5b29df2639078f42a44357ffd5c62cc10b951b1b1

Score

10^/10

raccoon c763e433ef51ff4b6c545800e4ba3b3b1a2ea077 stealer

Malware Config

Extracted

Family

raccoon

Botnet

c763e433ef51ff4b6c545800e4ba3b3b1a2ea077

Attributes

url4cnc
https://telete.in/jbitchsucks

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4308-140-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral2/memory/4308-141-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral2/memory/4308-142-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral2/memory/4308-143-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon

Loads dropped DLL 1 IoCs

Processes:

429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe

pid process

3120 429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe

pid	process
3120	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe

description	pid	process	target process
PID 3120 set thread context of 4308	3120	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe

pid process

3120 429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe

description pid process

Token: SeDebugPrivilege 3120 429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe

pid	process
3120	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe

description	pid	process
Token: SeDebugPrivilege	3120	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe

description	pid	process	target process
PID 3120 wrote to memory of 4308	3120	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe
PID 3120 wrote to memory of 4308	3120	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe
PID 3120 wrote to memory of 4308	3120	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe
PID 3120 wrote to memory of 4308	3120	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe
PID 3120 wrote to memory of 4308	3120	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe
PID 3120 wrote to memory of 4308	3120	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe
PID 3120 wrote to memory of 4308	3120	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe
PID 3120 wrote to memory of 4308	3120	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe
PID 3120 wrote to memory of 4308	3120	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe	429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe

C:\Users\Admin\AppData\Local\Temp\429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe
"C:\Users\Admin\AppData\Local\Temp\429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3120

C:\Users\Admin\AppData\Local\Temp\429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe
"C:\Users\Admin\AppData\Local\Temp\429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035.exe"
2⤵
PID:4308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4acacee3-cefe-4dab-b6f1-01f9a63ec79a\e.dll
Filesize
94KB

MD5
14ff402962ad21b78ae0b4c43cd1f194

SHA1
f8a510eb26666e875a5bdd1cadad40602763ad72

SHA256
fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

SHA512
daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

Download Submit
memory/3120-133-0x0000000000580000-0x0000000000760000-memory.dmp

Filesize
1.9MB

Download
memory/3120-134-0x0000000005CE0000-0x0000000006284000-memory.dmp

Filesize
5.6MB

Download
memory/3120-135-0x0000000005630000-0x0000000005674000-memory.dmp

Filesize
272KB

Download
memory/3120-136-0x0000000005730000-0x00000000057C2000-memory.dmp

Filesize
584KB

Download
memory/3120-138-0x0000000073060000-0x00000000730E9000-memory.dmp

Filesize
548KB

Download
memory/4308-139-0x0000000000000000-mapping.dmp

Download
memory/4308-140-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/4308-141-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/4308-142-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/4308-143-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads