raccoon | bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268

General

Target

bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
Size

394KB
MD5

d74c5647d791583241baa5061e0063c9
SHA1

e404c6041dca2f3b767231e38dfca8faecca10ca
SHA256

bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268
SHA512

7a60a3dc49c64f35a7d9b8838e45cb687f023778f65feb3c89d2465306bf1bfc300022e0ac1fbc7c2f5f8c69ce6b2bf78cabf2519a0919552d14ea4734ab579e
SSDEEP

12288:rkNkHyWEXeqvQYVby7+OLn2yTp/uzdGDHpc:skDqvQYV+qOL2y9/uzdGL

Score

10^/10

raccoon 6c8968d2498b99bf2d581580178f5f14 stealer

Malware Config

Extracted

Family

raccoon

Botnet

6c8968d2498b99bf2d581580178f5f14

C2

http://krrkrkrgsa.ink/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

Processes:

bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe

description	pid	process	target process
PID 2984 set thread context of 2112	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	jsc.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

Processes:

bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe

pid	process
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe

description pid process

Token: SeDebugPrivilege 2984 bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe

description	pid	process
Token: SeDebugPrivilege	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe

description	pid	process	target process
PID 2984 wrote to memory of 3100	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	SMSvcHost.exe
PID 2984 wrote to memory of 3100	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	SMSvcHost.exe
PID 2984 wrote to memory of 3084	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	aspnet_state.exe
PID 2984 wrote to memory of 3084	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	aspnet_state.exe
PID 2984 wrote to memory of 3104	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	mscorsvw.exe
PID 2984 wrote to memory of 3104	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	mscorsvw.exe
PID 2984 wrote to memory of 2588	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	ilasm.exe
PID 2984 wrote to memory of 2588	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	ilasm.exe
PID 2984 wrote to memory of 436	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	AddInProcess.exe
PID 2984 wrote to memory of 436	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	AddInProcess.exe
PID 2984 wrote to memory of 4984	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	ComSvcConfig.exe
PID 2984 wrote to memory of 4984	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	ComSvcConfig.exe
PID 2984 wrote to memory of 4988	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	RegAsm.exe
PID 2984 wrote to memory of 4988	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	RegAsm.exe
PID 2984 wrote to memory of 4276	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	AddInProcess32.exe
PID 2984 wrote to memory of 4276	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	AddInProcess32.exe
PID 2984 wrote to memory of 4276	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	AddInProcess32.exe
PID 2984 wrote to memory of 4348	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	InstallUtil.exe
PID 2984 wrote to memory of 4348	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	InstallUtil.exe
PID 2984 wrote to memory of 4996	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	aspnet_regbrowsers.exe
PID 2984 wrote to memory of 4996	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	aspnet_regbrowsers.exe
PID 2984 wrote to memory of 5008	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	ServiceModelReg.exe
PID 2984 wrote to memory of 5008	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	ServiceModelReg.exe
PID 2984 wrote to memory of 5016	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	csc.exe
PID 2984 wrote to memory of 5016	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	csc.exe
PID 2984 wrote to memory of 4712	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	AddInUtil.exe
PID 2984 wrote to memory of 4712	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	AddInUtil.exe
PID 2984 wrote to memory of 4732	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	ngentask.exe
PID 2984 wrote to memory of 4732	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	ngentask.exe
PID 2984 wrote to memory of 4816	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	MSBuild.exe
PID 2984 wrote to memory of 4816	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	MSBuild.exe
PID 2984 wrote to memory of 5024	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	vbc.exe
PID 2984 wrote to memory of 5024	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	vbc.exe
PID 2984 wrote to memory of 2112	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	jsc.exe
PID 2984 wrote to memory of 2112	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	jsc.exe
PID 2984 wrote to memory of 2112	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	jsc.exe
PID 2984 wrote to memory of 2112	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	jsc.exe
PID 2984 wrote to memory of 2112	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	jsc.exe
PID 2984 wrote to memory of 2112	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	jsc.exe
PID 2984 wrote to memory of 2112	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	jsc.exe
PID 2984 wrote to memory of 2112	2984	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	jsc.exe

C:\Users\Admin\AppData\Local\Temp\bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
"C:\Users\Admin\AppData\Local\Temp\bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
2⤵
PID:3100

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
2⤵
PID:3084

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
2⤵
PID:3104

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"
2⤵
PID:2588

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
2⤵
PID:436

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
2⤵
PID:4984

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
2⤵
PID:4988

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
2⤵
PID:4276

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
2⤵
PID:4348

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
2⤵
PID:4996

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
2⤵
PID:5008

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
2⤵
PID:5016

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"
2⤵
PID:4732

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
2⤵
PID:4816

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"
2⤵
PID:4712

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
2⤵
PID:5024

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
2⤵
PID:2112

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2112-118-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2112-119-0x00000000004088ED-mapping.dmp

Download
memory/2112-120-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-121-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-122-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-123-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-125-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-126-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-127-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-128-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-129-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-130-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-131-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-132-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-133-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-134-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-135-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-136-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-137-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-138-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2112-139-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-140-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-141-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-142-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-143-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-144-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-145-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-146-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2112-147-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-148-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-149-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-150-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-151-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-152-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-153-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-154-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-155-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-156-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-157-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-158-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-159-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-160-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-161-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-162-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-163-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-164-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-165-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-166-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-167-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-168-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-169-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-170-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-171-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2112-172-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2984-116-0x0000026507710000-0x0000026507778000-memory.dmp

Filesize
416KB

Download
memory/2984-117-0x0000026521AC0000-0x0000026521B1E000-memory.dmp

Filesize
376KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads