raccoon | efd98f1899a655601dface66665de85596a406396fa492725c4ad79764848ae9

Analysis

max time kernel
145s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

efd98f1899a655601dface66665de85596a406396fa492725c4ad79764848ae9.exe
Size

1.6MB
MD5

edba583f1dc93fb81750278507d21a56
SHA1

9777f04f51c292ae6943d093aae76dd5fab3c7ca
SHA256

efd98f1899a655601dface66665de85596a406396fa492725c4ad79764848ae9
SHA512

00087da125d6f041802287d2475cd30f41eedb09ebba001c55f0e08e89c2b5f865c7c38368f9f22cdd33e4d79b3d5bbac044126275122c2c872c2fdae724494a
SSDEEP

49152:b3kpPSVcsWAZpBjgO7HGZPL79fyaQtirOF:b3kpWcbAZpB7atH9fQt

Score

10^/10

raccoon bootkit persistence stealer

Malware Config

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

efd98f1899a655601dface66665de85596a406396fa492725c4ad79764848ae9.exe

description ioc process

File opened for modification \??\PhysicalDrive0 efd98f1899a655601dface66665de85596a406396fa492725c4ad79764848ae9.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	efd98f1899a655601dface66665de85596a406396fa492725c4ad79764848ae9.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

efd98f1899a655601dface66665de85596a406396fa492725c4ad79764848ae9.exe

pid	process
364	efd98f1899a655601dface66665de85596a406396fa492725c4ad79764848ae9.exe
364	efd98f1899a655601dface66665de85596a406396fa492725c4ad79764848ae9.exe

C:\Users\Admin\AppData\Local\Temp\efd98f1899a655601dface66665de85596a406396fa492725c4ad79764848ae9.exe
"C:\Users\Admin\AppData\Local\Temp\efd98f1899a655601dface66665de85596a406396fa492725c4ad79764848ae9.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:364

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/364-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/364-55-0x0000000000400000-0x0000000000A3F000-memory.dmp

Filesize
6.2MB

Download
memory/364-56-0x00000000001F0000-0x00000000001F3000-memory.dmp

Filesize
12KB

Download
memory/364-57-0x0000000000400000-0x0000000000A3F000-memory.dmp

Filesize
6.2MB

Download