raccoon | 07a0f741d265effa47ddd37ffcd92029535d0f8dc6b90ca43f753292768368ed

General

Target

07a0f741d265effa47ddd37ffcd92029535d0f8dc6b90ca43f753292768368ed.exe
Size

596KB
MD5

ccf9b8247afa3a47a6867f2164f235dd
SHA1

98ed0421e118c8e3c0075631c58ad837175d13c6
SHA256

07a0f741d265effa47ddd37ffcd92029535d0f8dc6b90ca43f753292768368ed
SHA512

ac89f3362f1481a61ae0303da707430001d7a3f948678e7f91c5b2172757d81537ac12b3a81913d7132f0d26813ed4566e597feb0150e36e06e36c71a073576c

Score

10^/10

raccoon d5fd0978f375b4c26af90035e90f506a7d35fc8c stealer

Malware Config

Extracted

Family

raccoon

Botnet

d5fd0978f375b4c26af90035e90f506a7d35fc8c

Attributes

url4cnc
https://drive.google.com/uc?export=download&id=1LsajrcmIAxXH1jkaNqtfZTdiUG11uAJ5

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1752-132-0x0000000000400000-0x0000000000C9B000-memory.dmp	family_raccoon
behavioral2/memory/1752-134-0x0000000000400000-0x0000000000C9B000-memory.dmp	family_raccoon

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Program crash 6 IoCs

pid	pid_target	Process	procid_target
4108	1752	WerFault.exe	77
4196	1752	WerFault.exe	77
1596	1752	WerFault.exe	77
4884	1752	WerFault.exe	77
4552	1752	WerFault.exe	77
228	1752	WerFault.exe	77

C:\Users\Admin\AppData\Local\Temp\07a0f741d265effa47ddd37ffcd92029535d0f8dc6b90ca43f753292768368ed.exe
"C:\Users\Admin\AppData\Local\Temp\07a0f741d265effa47ddd37ffcd92029535d0f8dc6b90ca43f753292768368ed.exe"
1⤵
PID:1752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 720
  2⤵
  - Program crash
  PID:4108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 736
  2⤵
  - Program crash
  PID:4196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 720
  2⤵
  - Program crash
  PID:1596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 900
  2⤵
  - Program crash
  PID:4884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 1148
  2⤵
  - Program crash
  PID:4552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 836
  2⤵
  - Program crash
  PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1752 -ip 1752
1⤵
PID:1240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1752 -ip 1752
1⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1752 -ip 1752
1⤵
PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1752 -ip 1752
1⤵
PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1752 -ip 1752
1⤵
PID:4000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1752 -ip 1752
1⤵
PID:368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

1

T1102

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1752-130-0x0000000000E48000-0x0000000000E8C000-memory.dmp

Filesize
272KB

Download
memory/1752-131-0x0000000000E48000-0x0000000000E8C000-memory.dmp

Filesize
272KB

Download
memory/1752-132-0x0000000000400000-0x0000000000C9B000-memory.dmp

Filesize
8.6MB

Download
memory/1752-133-0x0000000000E48000-0x0000000000E8C000-memory.dmp

Filesize
272KB

Download
memory/1752-134-0x0000000000400000-0x0000000000C9B000-memory.dmp

Filesize
8.6MB

Download

Analysis

Sharing