raccoon | fea56667376b74c28c7de850800fb6d3aa1d0c1984106a02b7124d86ec7a7080

Resubmissions

13/01/2023, 11:41

230113-nthbwsgf38 10

12/01/2023, 16:59

230112-vhc2csgg84 5

11/01/2023, 18:21

230111-wzsntahf31 5

Analysis

max time kernel
88s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2023, 11:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Software.exe
Size

449.2MB
MD5

d5f6325ec94040f2a6ad638378f68863
SHA1

b577eebec521d0c252426ce01d0a85e405619e84
SHA256

87c7a6eb8d9ec5de571f3f3283d2b5f857d2eb9a262ccb11d9cbae9da8b649af
SHA512

9da7cb47b04618d05c0477656c82f500080e6b4325eefe5f4d87d3d11a171fcbcfe830b676e419961378217be2c9a93040c361ae30c62de1a39d76e921bb06eb
SSDEEP

24576:Rgh/xuMApac4x8buUjQs5nyyx+NxEyaQ:ih/rApz4xauUMs5nyC+NqyaQ

Score

10^/10

raccoon e7d2fe83ae36b0e93e2735b36e2f6292 stealer

Malware Config

Extracted

Family

raccoon

Botnet

e7d2fe83ae36b0e93e2735b36e2f6292

http://94.131.98.89/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 780 set thread context of 3828	780	Software.exe	90

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 3828	780	Software.exe	90
PID 780 wrote to memory of 3828	780	Software.exe	90
PID 780 wrote to memory of 3828	780	Software.exe	90
PID 780 wrote to memory of 3828	780	Software.exe	90
PID 780 wrote to memory of 3828	780	Software.exe	90
PID 780 wrote to memory of 3828	780	Software.exe	90
PID 780 wrote to memory of 3828	780	Software.exe	90
PID 780 wrote to memory of 3828	780	Software.exe	90

C:\Users\Admin\AppData\Local\Temp\Software.exe
"C:\Users\Admin\AppData\Local\Temp\Software.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:780
- C:\Users\Admin\AppData\Local\Temp\Software.exe
  "C:\Users\Admin\AppData\Local\Temp\Software.exe"
  2⤵
  PID:3828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/780-132-0x0000000000750000-0x0000000000836000-memory.dmp

Filesize
920KB

Download
memory/780-133-0x0000000005750000-0x0000000005CF4000-memory.dmp

Filesize
5.6MB

Download
memory/780-134-0x00000000050E0000-0x0000000005172000-memory.dmp

Filesize
584KB

Download
memory/780-135-0x00000000050D0000-0x00000000050DA000-memory.dmp

Filesize
40KB

Download
memory/780-136-0x0000000007970000-0x0000000007A0C000-memory.dmp

Filesize
624KB

Download
memory/3828-138-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3828-140-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3828-141-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3828-142-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download