raccoon | 93cb7dd5d6bfd3d1d2d14b2f9bc1dbc57666343bfd42f289525e0999987c2d7e

Analysis

max time kernel
91s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2022, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
00d057121859b0cd9f095eccbb124acb.exe
Size 2.4MB
Sample221111-jcdj6aace5
SHA256 93cb7dd5d6bfd3d1d2d14b2f9bc1dbc57666343bfd42f289525e0999987c2d7e
MD5 00d057121859b0cd9f095eccbb124acb
SHA1 f03de44fc37e565100b09d2e49e467f6189f8b60
SHA512 6a26c27c2b45876b6c7a8d2eff424897c148623bacc12637a45844ecd6ded8ce1f64d70b0ea3dff3b0f9d1ff4b2bc7aa7354861e04c1dbad0dca7e58c884751f
SSDEEP 49152:Zj8f/j/n1kEagQzAi4R02J45jTUp92POuzEo5EaYJ/QR:ZofL/nHagQznClJe8p92PJEg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

raccoon 3a3e45a1a3ef665ee64f971dbb448f51 stealer

Malware Config

Extracted

Family

raccoon

Botnet

3a3e45a1a3ef665ee64f971dbb448f51

http://164.92.186.156/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3140 set thread context of 4896	3140	00d057121859b0cd9f095eccbb124acb.exe	80

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 920	3140	00d057121859b0cd9f095eccbb124acb.exe	79
PID 3140 wrote to memory of 920	3140	00d057121859b0cd9f095eccbb124acb.exe	79
PID 3140 wrote to memory of 920	3140	00d057121859b0cd9f095eccbb124acb.exe	79
PID 3140 wrote to memory of 4896	3140	00d057121859b0cd9f095eccbb124acb.exe	80
PID 3140 wrote to memory of 4896	3140	00d057121859b0cd9f095eccbb124acb.exe	80
PID 3140 wrote to memory of 4896	3140	00d057121859b0cd9f095eccbb124acb.exe	80
PID 3140 wrote to memory of 4896	3140	00d057121859b0cd9f095eccbb124acb.exe	80
PID 3140 wrote to memory of 4896	3140	00d057121859b0cd9f095eccbb124acb.exe	80

C:\Users\Admin\AppData\Local\Temp\00d057121859b0cd9f095eccbb124acb.exe
"C:\Users\Admin\AppData\Local\Temp\00d057121859b0cd9f095eccbb124acb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:4896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4896-134-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4896-140-0x0000000000400000-0x0000000000412000-memory.dmp