raccoon | bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268

General

Target

bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
Size

394KB
MD5

d74c5647d791583241baa5061e0063c9
SHA1

e404c6041dca2f3b767231e38dfca8faecca10ca
SHA256

bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268
SHA512

7a60a3dc49c64f35a7d9b8838e45cb687f023778f65feb3c89d2465306bf1bfc300022e0ac1fbc7c2f5f8c69ce6b2bf78cabf2519a0919552d14ea4734ab579e
SSDEEP

12288:rkNkHyWEXeqvQYVby7+OLn2yTp/uzdGDHpc:skDqvQYV+qOL2y9/uzdGL

Score

10^/10

raccoon 6c8968d2498b99bf2d581580178f5f14 stealer

Malware Config

Extracted

Family

raccoon

Botnet

6c8968d2498b99bf2d581580178f5f14

C2

http://krrkrkrgsa.ink/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Suspicious use of SetThreadContext 1 IoCs

Processes:

bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe

description	pid	process	target process
PID 4324 set thread context of 3980	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	jsc.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe

pid	process
4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe

description pid process

Token: SeDebugPrivilege 4324 bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe

description	pid	process
Token: SeDebugPrivilege	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe

description	pid	process	target process
PID 4324 wrote to memory of 5016	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	csc.exe
PID 4324 wrote to memory of 5016	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	csc.exe
PID 4324 wrote to memory of 4088	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	mscorsvw.exe
PID 4324 wrote to memory of 4088	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	mscorsvw.exe
PID 4324 wrote to memory of 2160	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	aspnet_wp.exe
PID 4324 wrote to memory of 2160	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	aspnet_wp.exe
PID 4324 wrote to memory of 2132	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	DataSvcUtil.exe
PID 4324 wrote to memory of 2132	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	DataSvcUtil.exe
PID 4324 wrote to memory of 1376	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	RegSvcs.exe
PID 4324 wrote to memory of 1376	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	RegSvcs.exe
PID 4324 wrote to memory of 2524	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	AppLaunch.exe
PID 4324 wrote to memory of 2524	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	AppLaunch.exe
PID 4324 wrote to memory of 1012	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	ComSvcConfig.exe
PID 4324 wrote to memory of 1012	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	ComSvcConfig.exe
PID 4324 wrote to memory of 372	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	ngentask.exe
PID 4324 wrote to memory of 372	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	ngentask.exe
PID 4324 wrote to memory of 432	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	MSBuild.exe
PID 4324 wrote to memory of 432	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	MSBuild.exe
PID 4324 wrote to memory of 300	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	CasPol.exe
PID 4324 wrote to memory of 300	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	CasPol.exe
PID 4324 wrote to memory of 4012	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	WsatConfig.exe
PID 4324 wrote to memory of 4012	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	WsatConfig.exe
PID 4324 wrote to memory of 3996	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	AddInProcess32.exe
PID 4324 wrote to memory of 3996	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	AddInProcess32.exe
PID 4324 wrote to memory of 3996	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	AddInProcess32.exe
PID 4324 wrote to memory of 3980	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	jsc.exe
PID 4324 wrote to memory of 3980	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	jsc.exe
PID 4324 wrote to memory of 3980	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	jsc.exe
PID 4324 wrote to memory of 3980	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	jsc.exe
PID 4324 wrote to memory of 3980	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	jsc.exe
PID 4324 wrote to memory of 3980	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	jsc.exe
PID 4324 wrote to memory of 3980	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	jsc.exe
PID 4324 wrote to memory of 3980	4324	bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe	jsc.exe

C:\Users\Admin\AppData\Local\Temp\bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe
"C:\Users\Admin\AppData\Local\Temp\bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4324

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
2⤵
PID:5016

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
2⤵
PID:4088

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
2⤵
PID:2160

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"
2⤵
PID:2132

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
2⤵
PID:1376

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
2⤵
PID:2524

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
2⤵
PID:1012

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"
2⤵
PID:372

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
2⤵
PID:432

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"
2⤵
PID:300

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
2⤵
PID:4012

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
2⤵
PID:3996

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
2⤵
PID:3980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3980-120-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3980-121-0x00000000004088ED-mapping.dmp

Download
memory/3980-122-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-123-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-124-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-125-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-127-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-128-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-129-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-130-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-131-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-132-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-133-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-134-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-135-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-136-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-138-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-137-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-139-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-140-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3980-141-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-142-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-143-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-144-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-145-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-146-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-147-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-148-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-149-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-150-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-151-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-152-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-153-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-154-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-155-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-157-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-156-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-158-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-159-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-160-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-161-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-162-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-163-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-164-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-166-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-165-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-167-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-168-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-169-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-170-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-171-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-172-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3980-173-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4324-118-0x00000189AAF40000-0x00000189AAFA8000-memory.dmp

Filesize
416KB

Download
memory/4324-119-0x00000189ACAD0000-0x00000189ACB2E000-memory.dmp

Filesize
376KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads