Overview

overview

10

Static

static

8256fb7045...10.exe

windows7_x64

3

8256fb7045...10.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 03:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8256fb70454da346b588b8d884ef5ffc0631c1dceeee515a0c92989d36dedd10.exe

  • Size

    1.3MB

  • MD5

    66afe24b36275f561cf6318653aaa6f4

  • SHA1

    94f4bdd9e38b17fac52471936cf7173d37cd001e

  • SHA256

    8256fb70454da346b588b8d884ef5ffc0631c1dceeee515a0c92989d36dedd10

  • SHA512

    4b99387f9b0b01ee25d0f728c735cb7d2f564602eb934b4ef7898e6ad532f2ccb304ed99ea9eab93bacfdcb81d01911ca0a0a5ebc75e4f92200ec760238bb582

Score
10/10
raccoon98ade1e00a4f6f9a223d8d49f21aeb26d0c74b4astealer

Malware Config

Extracted

Family

raccoon

Botnet

98ade1e00a4f6f9a223d8d49f21aeb26d0c74b4a

Attributes
  • url4cnc

    https://drive.google.com/uc?export=download&id=1oyq2bglZBUpcWekyvuAsh8ZchXcReacH

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon
  • Raccoon Stealer Payload 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8256fb70454da346b588b8d884ef5ffc0631c1dceeee515a0c92989d36dedd10.exe
    "C:\Users\Admin\AppData\Local\Temp\8256fb70454da346b588b8d884ef5ffc0631c1dceeee515a0c92989d36dedd10.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2068
    • C:\Users\Admin\AppData\Local\Temp\8256fb70454da346b588b8d884ef5ffc0631c1dceeee515a0c92989d36dedd10.exe
      C:\Users\Admin\AppData\Local\Temp\8256fb70454da346b588b8d884ef5ffc0631c1dceeee515a0c92989d36dedd10.exe
      2⤵
        PID:4684
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 768
          3⤵
          • Program crash
          PID:2712
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
      1⤵
        PID:4552
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4684 -ip 4684
        1⤵
          PID:1192

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Persistence

        Privilege Escalation

        Defense Evasion

        Credential Access

        Discovery

        Lateral Movement

        Collection

        Exfiltration

        Command and Control

        Web Service

        1
        T1102

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2068-130-0x0000000003CC0000-0x0000000003CD8000-memory.dmp
          Filesize

          96KB

          Download
        • memory/4684-131-0x0000000000000000-mapping.dmp
          Download
        • memory/4684-132-0x0000000000400000-0x0000000000489000-memory.dmp
          Filesize

          548KB

          Download
        • memory/4684-138-0x0000000000400000-0x0000000000489000-memory.dmp
          Filesize

          548KB

          Download