raccoon | 07a0f741d265effa47ddd37ffcd92029535d0f8dc6b90ca43f753292768368ed

Analysis

max time kernel
46s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
31-05-2022 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07a0f741d265effa47ddd37ffcd92029535d0f8dc6b90ca43f753292768368ed.exe
Size

596KB
MD5

ccf9b8247afa3a47a6867f2164f235dd
SHA1

98ed0421e118c8e3c0075631c58ad837175d13c6
SHA256

07a0f741d265effa47ddd37ffcd92029535d0f8dc6b90ca43f753292768368ed
SHA512

ac89f3362f1481a61ae0303da707430001d7a3f948678e7f91c5b2172757d81537ac12b3a81913d7132f0d26813ed4566e597feb0150e36e06e36c71a073576c

Score

10^/10

raccoon d5fd0978f375b4c26af90035e90f506a7d35fc8c stealer

Malware Config

Extracted

Family

raccoon

Botnet

d5fd0978f375b4c26af90035e90f506a7d35fc8c

Attributes

url4cnc
https://drive.google.com/uc?export=download&id=1LsajrcmIAxXH1jkaNqtfZTdiUG11uAJ5

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 2 IoCs

resource	yara_rule
behavioral1/memory/1524-57-0x0000000000400000-0x0000000000C9B000-memory.dmp	family_raccoon
behavioral1/memory/1524-59-0x0000000000400000-0x0000000000C9B000-memory.dmp	family_raccoon

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1208	1524	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 1208	1524	07a0f741d265effa47ddd37ffcd92029535d0f8dc6b90ca43f753292768368ed.exe	28
PID 1524 wrote to memory of 1208	1524	07a0f741d265effa47ddd37ffcd92029535d0f8dc6b90ca43f753292768368ed.exe	28
PID 1524 wrote to memory of 1208	1524	07a0f741d265effa47ddd37ffcd92029535d0f8dc6b90ca43f753292768368ed.exe	28
PID 1524 wrote to memory of 1208	1524	07a0f741d265effa47ddd37ffcd92029535d0f8dc6b90ca43f753292768368ed.exe	28

C:\Users\Admin\AppData\Local\Temp\07a0f741d265effa47ddd37ffcd92029535d0f8dc6b90ca43f753292768368ed.exe
"C:\Users\Admin\AppData\Local\Temp\07a0f741d265effa47ddd37ffcd92029535d0f8dc6b90ca43f753292768368ed.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 336
  2⤵
  - Program crash
  PID:1208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1524-54-0x0000000000E0A000-0x0000000000E4E000-memory.dmp

Filesize
272KB

Download
memory/1524-55-0x0000000076851000-0x0000000076853000-memory.dmp

Filesize
8KB

Download
memory/1524-56-0x0000000000E0A000-0x0000000000E4E000-memory.dmp

Filesize
272KB

Download
memory/1524-57-0x0000000000400000-0x0000000000C9B000-memory.dmp

Filesize
8.6MB

Download
memory/1524-59-0x0000000000400000-0x0000000000C9B000-memory.dmp

Filesize
8.6MB

Download