raccoon | 3f4ab40f84b5044f436b076024787a62f5444ab3549f49f8460ca6a72f949d00

Resubmissions

13/01/2023, 12:35

230113-pshfyagh56 10

10/01/2023, 12:21

230110-pjc5vsfh98 5

Analysis

max time kernel
89s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2023, 12:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup.exe
Size

450.0MB
MD5

cb2b683c08069259a1ad4eaa829cfeb4
SHA1

acae6f70cf1e360bb3656e936c45ca14d448f8c1
SHA256

0f08546b9b68ffd107a9bfb61985f1f07b7418e8a78b73eec441f8bbf2396de7
SHA512

7741c2e7ed7b62e930be73f1a49a17019ecd36a84bde628b50dd055d6e2940938f089f8c272a4a578af1db569b7ff702744d87762ea5fac1cbc019320b062e03
SSDEEP

24576:+S02yH58BY5FHoJhxIeeE98PKmyChWjzbyqo53xre6:o5t51pWkSyqo5Y

Score

10^/10

raccoon 3f5dbd517c907491b1a8f780714018c7 stealer

Malware Config

Extracted

Family

raccoon

Botnet

3f5dbd517c907491b1a8f780714018c7

http://94.131.98.88/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3268 set thread context of 3872	3268	Setup.exe	81

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 3872	3268	Setup.exe	81
PID 3268 wrote to memory of 3872	3268	Setup.exe	81
PID 3268 wrote to memory of 3872	3268	Setup.exe	81
PID 3268 wrote to memory of 3872	3268	Setup.exe	81
PID 3268 wrote to memory of 3872	3268	Setup.exe	81
PID 3268 wrote to memory of 3872	3268	Setup.exe	81
PID 3268 wrote to memory of 3872	3268	Setup.exe	81
PID 3268 wrote to memory of 3872	3268	Setup.exe	81
PID 3268 wrote to memory of 3872	3268	Setup.exe	81

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:3872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3268-132-0x0000016089A10000-0x0000016089BAE000-memory.dmp

Filesize
1.6MB

Download
memory/3268-133-0x00007FFA98510000-0x00007FFA98FD1000-memory.dmp

Filesize
10.8MB

Download
memory/3268-137-0x00007FFA98510000-0x00007FFA98FD1000-memory.dmp

Filesize
10.8MB

Download
memory/3872-134-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3872-138-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3872-139-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3872-140-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download