raccoon | 3f4ab40f84b5044f436b076024787a62f5444ab3549f49f8460ca6a72f949d00 | Triage

Resubmissions

13/01/2023, 12:35

230113-pshfyagh56 10

10/01/2023, 12:21

230110-pjc5vsfh98 5

Analysis

max time kernel
42s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
13/01/2023, 12:35

Sharing

Report Analysis Logs

General

Target

Setup.exe
Size

450.0MB
MD5

cb2b683c08069259a1ad4eaa829cfeb4
SHA1

acae6f70cf1e360bb3656e936c45ca14d448f8c1
SHA256

0f08546b9b68ffd107a9bfb61985f1f07b7418e8a78b73eec441f8bbf2396de7
SHA512

7741c2e7ed7b62e930be73f1a49a17019ecd36a84bde628b50dd055d6e2940938f089f8c272a4a578af1db569b7ff702744d87762ea5fac1cbc019320b062e03
SSDEEP

24576:+S02yH58BY5FHoJhxIeeE98PKmyChWjzbyqo53xre6:o5t51pWkSyqo5Y

Score

10^/10

raccoon 3f5dbd517c907491b1a8f780714018c7 stealer

Malware Config

Extracted

Family

raccoon

Botnet

3f5dbd517c907491b1a8f780714018c7

C2

http://94.131.98.88/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1156 set thread context of 1616	1156	Setup.exe	27

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 1616	1156	Setup.exe	27
PID 1156 wrote to memory of 1616	1156	Setup.exe	27
PID 1156 wrote to memory of 1616	1156	Setup.exe	27
PID 1156 wrote to memory of 1616	1156	Setup.exe	27
PID 1156 wrote to memory of 1616	1156	Setup.exe	27
PID 1156 wrote to memory of 1616	1156	Setup.exe	27
PID 1156 wrote to memory of 1616	1156	Setup.exe	27
PID 1156 wrote to memory of 1616	1156	Setup.exe	27
PID 1156 wrote to memory of 1616	1156	Setup.exe	27
PID 1156 wrote to memory of 1616	1156	Setup.exe	27
PID 1156 wrote to memory of 1616	1156	Setup.exe	27
PID 1156 wrote to memory of 1616	1156	Setup.exe	27
PID 1156 wrote to memory of 1616	1156	Setup.exe	27

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:1616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1156-54-0x00000000013A0000-0x000000000153E000-memory.dmp

Filesize
1.6MB

Download
memory/1156-55-0x000000001B380000-0x000000001B400000-memory.dmp

Filesize
512KB

Download
memory/1616-56-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download