raccoon | 30a261fb001f66df09d1eb84f378b8d43e61a13770de476601ea9d4457b7a8cb

Analysis

max time kernel
83s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2022, 11:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2cb8116e30e7f3f3615d1f763f690abc.exe
Size 2.3MB
Sample221102-nnad4abeb4
SHA256 30a261fb001f66df09d1eb84f378b8d43e61a13770de476601ea9d4457b7a8cb
MD5 2cb8116e30e7f3f3615d1f763f690abc
SHA1 a87d3b4eae78311a673f0e6cc60b80a60228b88e
SHA512 632d6badfe43966b52b6beab208536cc6b5e67a463c35b9de1b5edc680452512a6db6b8779d758ad29210bbc66f8bce681e365fb60da25dab664bef6fdf9426b
SSDEEP 24576:KwpJSYrYccLcHe/M4P8QugVQONZNGRbZ01TGimwL/sasXDv09l3RuQ55313a:KwpONiRbZ01TGimwz9l3k
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

raccoon e734a12bc6119609a0b6a8bee6270055 stealer

Malware Config

Extracted

Family

raccoon

Botnet

e734a12bc6119609a0b6a8bee6270055

http://89.185.85.53/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4596 set thread context of 2348	4596	2cb8116e30e7f3f3615d1f763f690abc.exe	81

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 2348	4596	2cb8116e30e7f3f3615d1f763f690abc.exe	81
PID 4596 wrote to memory of 2348	4596	2cb8116e30e7f3f3615d1f763f690abc.exe	81
PID 4596 wrote to memory of 2348	4596	2cb8116e30e7f3f3615d1f763f690abc.exe	81
PID 4596 wrote to memory of 2348	4596	2cb8116e30e7f3f3615d1f763f690abc.exe	81
PID 4596 wrote to memory of 2348	4596	2cb8116e30e7f3f3615d1f763f690abc.exe	81

C:\Users\Admin\AppData\Local\Temp\2cb8116e30e7f3f3615d1f763f690abc.exe
"C:\Users\Admin\AppData\Local\Temp\2cb8116e30e7f3f3615d1f763f690abc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2348-133-0x0000000000120000-0x0000000000132000-memory.dmp

Download

memory/2348-140-0x0000000000120000-0x0000000000132000-memory.dmp