raccoon | ab34c13eca2976803093e415028716db9042827537cf02b3c26643b1a1e39ed8

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
17-11-2022 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88259b6f581671ac2c3243699a77457a.exe
Size

843KB
MD5

88259b6f581671ac2c3243699a77457a
SHA1

be0d1380ef2de12a1ea763158e0f3e4e2847e8c2
SHA256

ab34c13eca2976803093e415028716db9042827537cf02b3c26643b1a1e39ed8
SHA512

efc303093dc17ec8cbbbaec40aaf59f8869298396066acb33a56a22daeae5a0d32142d8bc6a9dca7491ed4c90f4ec0eb8636c1d2017e678dce37210d5cb60622
SSDEEP

12288:Wknl8gLO+AG/gAsZmk3AB/qwf83LdH7Ndqd8YKQHmuAnYKqA/OsH:fnl8gy+AG/gm/s7NdqB/H

Score

10^/10

raccoon d8f44b07b06da3a90ad87ebc9249718c stealer

Malware Config

Extracted

Family

raccoon

Botnet

d8f44b07b06da3a90ad87ebc9249718c

http://79.137.205.87/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

88259b6f581671ac2c3243699a77457a.exe

description pid process target process

PID 2016 set thread context of 1120 2016 88259b6f581671ac2c3243699a77457a.exe vbc.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1552 2016 WerFault.exe 88259b6f581671ac2c3243699a77457a.exe

description	pid	process	target process
PID 2016 set thread context of 1120	2016	88259b6f581671ac2c3243699a77457a.exe	vbc.exe

pid	pid_target	process	target process
1552	2016	WerFault.exe	88259b6f581671ac2c3243699a77457a.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

88259b6f581671ac2c3243699a77457a.exe

description	pid	process	target process
PID 2016 wrote to memory of 1120	2016	88259b6f581671ac2c3243699a77457a.exe	vbc.exe
PID 2016 wrote to memory of 1120	2016	88259b6f581671ac2c3243699a77457a.exe	vbc.exe
PID 2016 wrote to memory of 1120	2016	88259b6f581671ac2c3243699a77457a.exe	vbc.exe
PID 2016 wrote to memory of 1120	2016	88259b6f581671ac2c3243699a77457a.exe	vbc.exe
PID 2016 wrote to memory of 1120	2016	88259b6f581671ac2c3243699a77457a.exe	vbc.exe
PID 2016 wrote to memory of 1120	2016	88259b6f581671ac2c3243699a77457a.exe	vbc.exe
PID 2016 wrote to memory of 1552	2016	88259b6f581671ac2c3243699a77457a.exe	WerFault.exe
PID 2016 wrote to memory of 1552	2016	88259b6f581671ac2c3243699a77457a.exe	WerFault.exe
PID 2016 wrote to memory of 1552	2016	88259b6f581671ac2c3243699a77457a.exe	WerFault.exe
PID 2016 wrote to memory of 1552	2016	88259b6f581671ac2c3243699a77457a.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\88259b6f581671ac2c3243699a77457a.exe
"C:\Users\Admin\AppData\Local\Temp\88259b6f581671ac2c3243699a77457a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:1120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 36
2⤵
- Program crash
PID:1552

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1120-54-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1120-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1120-62-0x00000000004088B5-mapping.dmp

Download
memory/1552-63-0x0000000000000000-mapping.dmp

Download