raccoon | 649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87

General

Target

649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe
Size

830KB
MD5

eb5fcfda27dd7dba6489e9235cb0ebb3
SHA1

214d444e61f2ce14eda1d8eb8d6cc46649e67f36
SHA256

649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87
SHA512

0c03ec4898e15e6d8002477433620feb5f2ecf6f98614691c92f81c81922707b7589523c0b172854fa0bd3f47680b4219c18f04fc26a06ff529c77bcf276a172
SSDEEP

12288:MMN7mUCD1sJ86iVAClceomYDjPVnsOUErboVyj4Q/:z7mTWgVPl9ofDe0HPjj

Score

10^/10

raccoon 5eaa41b3101d5537f786a35da1878f0d1d760e53 stealer

Malware Config

Extracted

Family

raccoon

Version

1.7.1-hotfix

Botnet

5eaa41b3101d5537f786a35da1878f0d1d760e53

Attributes

url4cnc
https://telete.in/jbitchsucks

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1704-64-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral1/memory/1704-66-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral1/memory/1704-68-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral1/memory/1704-69-0x000000000043FBCC-mapping.dmp	family_raccoon
behavioral1/memory/1704-72-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral1/memory/1704-73-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon

Suspicious use of SetThreadContext 1 IoCs

Processes:

649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe

description	pid	process	target process
PID 1708 set thread context of 1704	1708	649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe	649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe

description pid process

Token: SeDebugPrivilege 1708 649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe

description	pid	process
Token: SeDebugPrivilege	1708	649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe

description	pid	process	target process
PID 1708 wrote to memory of 1704	1708	649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe	649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe
PID 1708 wrote to memory of 1704	1708	649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe	649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe
PID 1708 wrote to memory of 1704	1708	649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe	649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe
PID 1708 wrote to memory of 1704	1708	649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe	649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe
PID 1708 wrote to memory of 1704	1708	649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe	649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe
PID 1708 wrote to memory of 1704	1708	649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe	649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe
PID 1708 wrote to memory of 1704	1708	649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe	649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe
PID 1708 wrote to memory of 1704	1708	649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe	649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe
PID 1708 wrote to memory of 1704	1708	649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe	649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe
PID 1708 wrote to memory of 1704	1708	649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe	649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe

C:\Users\Admin\AppData\Local\Temp\649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe
"C:\Users\Admin\AppData\Local\Temp\649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708

C:\Users\Admin\AppData\Local\Temp\649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe
"C:\Users\Admin\AppData\Local\Temp\649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87.exe"
2⤵
PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-66-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1704-64-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1704-73-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1704-72-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1704-69-0x000000000043FBCC-mapping.dmp

Download
memory/1704-59-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1704-60-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1704-62-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1704-68-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1708-54-0x0000000001290000-0x0000000001366000-memory.dmp

Filesize
856KB

Download
memory/1708-55-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download
memory/1708-58-0x0000000000630000-0x000000000064C000-memory.dmp

Filesize
112KB

Download
memory/1708-57-0x0000000004E20000-0x0000000004EA6000-memory.dmp

Filesize
536KB

Download
memory/1708-56-0x00000000011F0000-0x000000000125A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads