raccoon | bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b

General

Target

bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe
Size

1.6MB
MD5

8bab62e8bc62a0040707e05735e96ce6
SHA1

b7381f5e7ffdb1a7d8d6d1a233b49132f5e2d6ae
SHA256

bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b
SHA512

17b2631abcd284046ccc00b4ef7f1870c93fb6889381d6b653b78aa07a8bb93f9c2c5a41aed8b69d5d7c0cfc95c3f82d9202499988d24e69b0a2118fb430ac65

Score

10^/10

raccoon b92a235bffa69e2c5cbe1e5e08c8f58c785cae24 stealer

Malware Config

Extracted

Family

raccoon

Botnet

b92a235bffa69e2c5cbe1e5e08c8f58c785cae24

Attributes

url4cnc
https://telete.in/jrubixred

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2028-64-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral1/memory/2028-66-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral1/memory/2028-69-0x0000000000440131-mapping.dmp	family_raccoon
behavioral1/memory/2028-68-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral1/memory/2028-72-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral1/memory/2028-73-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon

Suspicious use of SetThreadContext 1 IoCs

Processes:

bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe

description	pid	process	target process
PID 940 set thread context of 2028	940	bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe	bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe

description pid process

Token: SeDebugPrivilege 940 bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe

description	pid	process
Token: SeDebugPrivilege	940	bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe

description	pid	process	target process
PID 940 wrote to memory of 2028	940	bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe	bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe
PID 940 wrote to memory of 2028	940	bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe	bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe
PID 940 wrote to memory of 2028	940	bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe	bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe
PID 940 wrote to memory of 2028	940	bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe	bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe
PID 940 wrote to memory of 2028	940	bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe	bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe
PID 940 wrote to memory of 2028	940	bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe	bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe
PID 940 wrote to memory of 2028	940	bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe	bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe
PID 940 wrote to memory of 2028	940	bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe	bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe
PID 940 wrote to memory of 2028	940	bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe	bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe
PID 940 wrote to memory of 2028	940	bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe	bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe

C:\Users\Admin\AppData\Local\Temp\bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe
"C:\Users\Admin\AppData\Local\Temp\bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940

C:\Users\Admin\AppData\Local\Temp\bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe
"C:\Users\Admin\AppData\Local\Temp\bf5ba4ab18a2af400c738295bee87eb200bdf10f9f2ecba49d7fa477d952c67b.exe"
2⤵
PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/940-54-0x0000000001110000-0x0000000001258000-memory.dmp

Filesize
1.3MB

Download
memory/940-55-0x0000000076C01000-0x0000000076C03000-memory.dmp

Filesize
8KB

Download
memory/940-56-0x00000000005E0000-0x00000000005E8000-memory.dmp

Filesize
32KB

Download
memory/940-57-0x0000000005520000-0x00000000055D8000-memory.dmp

Filesize
736KB

Download
memory/940-58-0x0000000005740000-0x00000000057D8000-memory.dmp

Filesize
608KB

Download
memory/2028-59-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2028-60-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2028-62-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2028-64-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2028-66-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2028-69-0x0000000000440131-mapping.dmp

Download
memory/2028-68-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2028-72-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2028-73-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads