raccoon | e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3

General

Target

e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe
Size

2.5MB
MD5

0d48cb857d930b968876f0616fc175b1
SHA1

0d506c8ced881691e13bddd8dc822fb45b934ad2
SHA256

e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3
SHA512

08e4bab8421a88a087e7882cc41546db3a2e9a5f4295ad469e878219573f8766210136a2e8910a8072105466b6c2e7636e97d7f6a4dc20153bef66e0adbbf5d4

Score

10^/10

raccoon c763e433ef51ff4b6c545800e4ba3b3b1a2ea077 stealer

Malware Config

Extracted

Family

raccoon

Botnet

c763e433ef51ff4b6c545800e4ba3b3b1a2ea077

Attributes

url4cnc
https://telete.in/jbitchsucks

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1240-65-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral1/memory/1240-67-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral1/memory/1240-69-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral1/memory/1240-70-0x000000000043FCC3-mapping.dmp	family_raccoon
behavioral1/memory/1240-73-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral1/memory/1240-74-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon

Loads dropped DLL 1 IoCs

Processes:

e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe

pid process

1200 e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe

pid	process
1200	e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe

description	pid	process	target process
PID 1200 set thread context of 1240	1200	e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe	e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe

pid process

1200 e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe

description pid process

Token: SeDebugPrivilege 1200 e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe

pid	process
1200	e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe

description	pid	process
Token: SeDebugPrivilege	1200	e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe

description	pid	process	target process
PID 1200 wrote to memory of 1240	1200	e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe	e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe
PID 1200 wrote to memory of 1240	1200	e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe	e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe
PID 1200 wrote to memory of 1240	1200	e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe	e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe
PID 1200 wrote to memory of 1240	1200	e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe	e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe
PID 1200 wrote to memory of 1240	1200	e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe	e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe
PID 1200 wrote to memory of 1240	1200	e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe	e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe
PID 1200 wrote to memory of 1240	1200	e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe	e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe
PID 1200 wrote to memory of 1240	1200	e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe	e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe
PID 1200 wrote to memory of 1240	1200	e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe	e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe
PID 1200 wrote to memory of 1240	1200	e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe	e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe

C:\Users\Admin\AppData\Local\Temp\e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe
"C:\Users\Admin\AppData\Local\Temp\e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200

C:\Users\Admin\AppData\Local\Temp\e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe
"C:\Users\Admin\AppData\Local\Temp\e1855703193393b22bd8a978dfe9428d6f357cb6773c5126d42a08b9faed33c3.exe"
2⤵
PID:1240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\4acacee3-cefe-4dab-b6f1-01f9a63ec79a\e.dll
Filesize
94KB

MD5
14ff402962ad21b78ae0b4c43cd1f194

SHA1
f8a510eb26666e875a5bdd1cadad40602763ad72

SHA256
fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

SHA512
daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

Download Submit
memory/1200-54-0x0000000000FC0000-0x00000000011DA000-memory.dmp

Filesize
2.1MB

Download
memory/1200-55-0x0000000076191000-0x0000000076193000-memory.dmp

Filesize
8KB

Download
memory/1200-56-0x0000000000550000-0x000000000057C000-memory.dmp

Filesize
176KB

Download
memory/1200-59-0x0000000000C00000-0x0000000000C0C000-memory.dmp

Filesize
48KB

Download
memory/1240-61-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1240-60-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1240-63-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1240-65-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1240-67-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1240-69-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1240-70-0x000000000043FCC3-mapping.dmp

Download
memory/1240-73-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1240-74-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads