raccoon | 8d197934ea6b6f1beee50ffce69efcf7172c00bb59fc44371ed85c2dca0a0e89

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2022 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d197934ea6b6f1beee50ffce69efcf7172c00bb59fc44371ed85c2dca0a0e89.exe
Size

2.5MB
MD5

bd6b21b99dd64f2c77009d2dea1ea086
SHA1

a2a136c265189a299ed2dff677f70d1f1ca83dea
SHA256

8d197934ea6b6f1beee50ffce69efcf7172c00bb59fc44371ed85c2dca0a0e89
SHA512

c2cbc36d23161a1c32bc304b50eae8ca6be16bac4d7fae2ad5921802caae979628d04f56349cd9de4d6fc7ebe938d0416a548984eb4605b39945f8b976208b10
SSDEEP

24576:rayYEvGwJ82uYqY8wNvbbMoxK2DdxdE4LxK9xD6MLTRmq+CLlqzTg/l3RuQ5531S:rZYEewJ8YeFTRmq+CBqCl3U

Score

10^/10

raccoon ce21570f8b07f4e68bfb7f44917635b1 stealer

Malware Config

Extracted

Family

raccoon

Botnet

ce21570f8b07f4e68bfb7f44917635b1

http://77.73.133.7/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

Processes:

8d197934ea6b6f1beee50ffce69efcf7172c00bb59fc44371ed85c2dca0a0e89.exe

description	pid	process	target process
PID 1344 set thread context of 100224	1344	8d197934ea6b6f1beee50ffce69efcf7172c00bb59fc44371ed85c2dca0a0e89.exe	vbc.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

8d197934ea6b6f1beee50ffce69efcf7172c00bb59fc44371ed85c2dca0a0e89.exe

description	pid	process	target process
PID 1344 wrote to memory of 100224	1344	8d197934ea6b6f1beee50ffce69efcf7172c00bb59fc44371ed85c2dca0a0e89.exe	vbc.exe
PID 1344 wrote to memory of 100224	1344	8d197934ea6b6f1beee50ffce69efcf7172c00bb59fc44371ed85c2dca0a0e89.exe	vbc.exe
PID 1344 wrote to memory of 100224	1344	8d197934ea6b6f1beee50ffce69efcf7172c00bb59fc44371ed85c2dca0a0e89.exe	vbc.exe
PID 1344 wrote to memory of 100224	1344	8d197934ea6b6f1beee50ffce69efcf7172c00bb59fc44371ed85c2dca0a0e89.exe	vbc.exe
PID 1344 wrote to memory of 100224	1344	8d197934ea6b6f1beee50ffce69efcf7172c00bb59fc44371ed85c2dca0a0e89.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\8d197934ea6b6f1beee50ffce69efcf7172c00bb59fc44371ed85c2dca0a0e89.exe
"C:\Users\Admin\AppData\Local\Temp\8d197934ea6b6f1beee50ffce69efcf7172c00bb59fc44371ed85c2dca0a0e89.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:100224

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/100224-132-0x0000000000000000-mapping.dmp

Download
memory/100224-133-0x0000000000570000-0x0000000000584000-memory.dmp

Filesize
80KB

Download
memory/100224-140-0x0000000000570000-0x0000000000584000-memory.dmp

Filesize
80KB

Download