raccoon | 63063e348f64b0e237c00a0adb6ca1d2d7020898192834f68d2dad4956a04e4a

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22/10/2022, 18:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6498f1b5556f9ad1998b20313a6b0d77.exe
Size 278KB
Sample221022-xcbmfsecg7
SHA256 63063e348f64b0e237c00a0adb6ca1d2d7020898192834f68d2dad4956a04e4a
MD5 6498f1b5556f9ad1998b20313a6b0d77
SHA1 ca3d7b86e13d3477b984738582bf926bbf274048
SHA512 77967b4ee1e9e3ffce19107f1bdcd783d1873f40543f39f73cd9fb7fa85a8a99aa297ce755d58f7137042d48bd0c5bdb9034a0fdd4e1b8824d6d4ddd18ec36cf
SSDEEP 3072:nlh4LI7aTKNpjfDdNL29qhKUkddxJ0USD8gXX8TOzC+wA4Qh/+d2l6GkdM2Dq:lh4DTK/jLi8D8gXXlBw451l6ZdMf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

raccoon d1d6daf7a5018968dea23d67c142f047 stealer

Malware Config

Extracted

Family

raccoon

Botnet

d1d6daf7a5018968dea23d67c142f047

http://5.255.103.158/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1960 set thread context of 4776	1960	6498f1b5556f9ad1998b20313a6b0d77.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1960	6498f1b5556f9ad1998b20313a6b0d77.exe
1960	6498f1b5556f9ad1998b20313a6b0d77.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	6498f1b5556f9ad1998b20313a6b0d77.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 3480	1960	6498f1b5556f9ad1998b20313a6b0d77.exe	83
PID 1960 wrote to memory of 3480	1960	6498f1b5556f9ad1998b20313a6b0d77.exe	83
PID 1960 wrote to memory of 3480	1960	6498f1b5556f9ad1998b20313a6b0d77.exe	83
PID 1960 wrote to memory of 4776	1960	6498f1b5556f9ad1998b20313a6b0d77.exe	84
PID 1960 wrote to memory of 4776	1960	6498f1b5556f9ad1998b20313a6b0d77.exe	84
PID 1960 wrote to memory of 4776	1960	6498f1b5556f9ad1998b20313a6b0d77.exe	84
PID 1960 wrote to memory of 4776	1960	6498f1b5556f9ad1998b20313a6b0d77.exe	84
PID 1960 wrote to memory of 4776	1960	6498f1b5556f9ad1998b20313a6b0d77.exe	84
PID 1960 wrote to memory of 4776	1960	6498f1b5556f9ad1998b20313a6b0d77.exe	84
PID 1960 wrote to memory of 4776	1960	6498f1b5556f9ad1998b20313a6b0d77.exe	84
PID 1960 wrote to memory of 4776	1960	6498f1b5556f9ad1998b20313a6b0d77.exe	84
PID 1960 wrote to memory of 4776	1960	6498f1b5556f9ad1998b20313a6b0d77.exe	84

C:\Users\Admin\AppData\Local\Temp\6498f1b5556f9ad1998b20313a6b0d77.exe
"C:\Users\Admin\AppData\Local\Temp\6498f1b5556f9ad1998b20313a6b0d77.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\6498f1b5556f9ad1998b20313a6b0d77.exe
  C:\Users\Admin\AppData\Local\Temp\6498f1b5556f9ad1998b20313a6b0d77.exe
  2⤵
  PID:3480
- C:\Users\Admin\AppData\Local\Temp\6498f1b5556f9ad1998b20313a6b0d77.exe
  C:\Users\Admin\AppData\Local\Temp\6498f1b5556f9ad1998b20313a6b0d77.exe
  2⤵
  PID:4776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1960-132-0x0000000000100000-0x000000000014A000-memory.dmp

Download

memory/1960-133-0x0000000005780000-0x00000000057A2000-memory.dmp

Download

memory/1960-134-0x0000000005880000-0x00000000058E6000-memory.dmp

Download

memory/1960-135-0x0000000026940000-0x00000000269D2000-memory.dmp

Download

memory/1960-136-0x0000000026F90000-0x0000000027534000-memory.dmp

Download

memory/4776-139-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4776-141-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4776-142-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4776-143-0x0000000000400000-0x0000000000414000-memory.dmp

Download