raccoon | 37670f71a35213217cab145aa7e262e0e46e411007b2d68f26e74c3d44693e95 | Triage

Analysis

max time kernel
94s
max time network
91s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
11-08-2022 02:05

Sharing

Report Analysis Logs

General

Target

Opensea Mint/Launcher.exe
Size

2.4MB
MD5

4cd71ee88eab1d1774584e560dd05a5e
SHA1

e359c0e8fe530d3bca70a3eecaed20df051d0e75
SHA256

2318aab19d001baa674543b6fef1626ae23731f38ceaee3babcc643c9ae88a1f
SHA512

7e46d2dcc44dd5b65c6a2857d08fa1226b6df69c089261c894096343c0a868b2e0d6965e7d1ea5c69336c6846a2dfe56736912f497ae7640fbf264859aecf166

Score

10^/10

raccoon 7af9c6169887d79cc4d744abe122c9c2 stealer

Malware Config

Extracted

Family

raccoon

Botnet

7af9c6169887d79cc4d744abe122c9c2

C2

http://213.252.247.130/

http://213.252.247.152/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral5/memory/1976-55-0x0000000000F60000-0x00000000018F4000-memory.dmp	family_raccoon
behavioral5/memory/1976-57-0x0000000000F60000-0x00000000018F4000-memory.dmp	family_raccoon

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Launcher.exe

pid process

1976 Launcher.exe
1976 Launcher.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

Launcher.exe

pid	process
1976	Launcher.exe
1976	Launcher.exe
1976	Launcher.exe
1976	Launcher.exe
1976	Launcher.exe
1976	Launcher.exe
1976	Launcher.exe
1976	Launcher.exe
1976	Launcher.exe
1976	Launcher.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Launcher.exe

pid process

1976 Launcher.exe

C:\Users\Admin\AppData\Local\Temp\Opensea Mint\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Opensea Mint\Launcher.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1976-54-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/1976-55-0x0000000000F60000-0x00000000018F4000-memory.dmp

Filesize
9.6MB

Download
memory/1976-56-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/1976-57-0x0000000000F60000-0x00000000018F4000-memory.dmp

Filesize
9.6MB

Download