raccoon | 07a0f741d265effa47ddd37ffcd92029535d0f8dc6b90ca43f753292768368ed

Analysis

max time kernel
46s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
31-05-2022 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07a0f741d265effa47ddd37ffcd92029535d0f8dc6b90ca43f753292768368ed.exe
Size

596KB
MD5

ccf9b8247afa3a47a6867f2164f235dd
SHA1

98ed0421e118c8e3c0075631c58ad837175d13c6
SHA256

07a0f741d265effa47ddd37ffcd92029535d0f8dc6b90ca43f753292768368ed
SHA512

ac89f3362f1481a61ae0303da707430001d7a3f948678e7f91c5b2172757d81537ac12b3a81913d7132f0d26813ed4566e597feb0150e36e06e36c71a073576c

Score

10^/10

raccoon d5fd0978f375b4c26af90035e90f506a7d35fc8c stealer

Malware Config

Extracted

Family

raccoon

Botnet

d5fd0978f375b4c26af90035e90f506a7d35fc8c

Attributes

url4cnc
https://drive.google.com/uc?export=download&id=1LsajrcmIAxXH1jkaNqtfZTdiUG11uAJ5

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1524-57-0x0000000000400000-0x0000000000C9B000-memory.dmp	family_raccoon
behavioral1/memory/1524-59-0x0000000000400000-0x0000000000C9B000-memory.dmp	family_raccoon

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1208 1524 WerFault.exe 07a0f741d265effa47ddd37ffcd92029535d0f8dc6b90ca43f753292768368ed.exe

pid	pid_target	process	target process
1208	1524	WerFault.exe	07a0f741d265effa47ddd37ffcd92029535d0f8dc6b90ca43f753292768368ed.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

07a0f741d265effa47ddd37ffcd92029535d0f8dc6b90ca43f753292768368ed.exe

description	pid	process	target process
PID 1524 wrote to memory of 1208	1524	07a0f741d265effa47ddd37ffcd92029535d0f8dc6b90ca43f753292768368ed.exe	WerFault.exe
PID 1524 wrote to memory of 1208	1524	07a0f741d265effa47ddd37ffcd92029535d0f8dc6b90ca43f753292768368ed.exe	WerFault.exe
PID 1524 wrote to memory of 1208	1524	07a0f741d265effa47ddd37ffcd92029535d0f8dc6b90ca43f753292768368ed.exe	WerFault.exe
PID 1524 wrote to memory of 1208	1524	07a0f741d265effa47ddd37ffcd92029535d0f8dc6b90ca43f753292768368ed.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\07a0f741d265effa47ddd37ffcd92029535d0f8dc6b90ca43f753292768368ed.exe
"C:\Users\Admin\AppData\Local\Temp\07a0f741d265effa47ddd37ffcd92029535d0f8dc6b90ca43f753292768368ed.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 336
2⤵
- Program crash
PID:1208

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1208-58-0x0000000000000000-mapping.dmp

Download
memory/1524-54-0x0000000000E0A000-0x0000000000E4E000-memory.dmp

Filesize
272KB

Download
memory/1524-55-0x0000000076851000-0x0000000076853000-memory.dmp

Filesize
8KB

Download
memory/1524-56-0x0000000000E0A000-0x0000000000E4E000-memory.dmp

Filesize
272KB

Download
memory/1524-57-0x0000000000400000-0x0000000000C9B000-memory.dmp

Filesize
8.6MB

Download
memory/1524-59-0x0000000000400000-0x0000000000C9B000-memory.dmp

Filesize
8.6MB

Download