raccoon | ec3c75c8e1cb7e105ae92a9912afa6a5b887023fc8a7b50fdf56abcf8eb9fad1

Analysis

max time kernel
161s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 17:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec3c75c8e1cb7e105ae92a9912afa6a5b887023fc8a7b50fdf56abcf8eb9fad1.exe
Size

530KB
MD5

85a8de2d7ce5d76102908b62db78153b
SHA1

80df8bd1cdbfb89f6bf3b22ca3c03dcdc94b35c9
SHA256

ec3c75c8e1cb7e105ae92a9912afa6a5b887023fc8a7b50fdf56abcf8eb9fad1
SHA512

0dd61cc5660874f834ab5781de218567ed0bcbb316b1de4fa64af07e39a9bdd6754913c75b95a05c9bf177ae20e3b47ab035b84c3446aa4b98a9f1d1b5a8a121
SSDEEP

12288:ci0PO4kbyhBEA920SFk+ZsiCX5cZ1uobgX9To647FpVX:ciHbyhu00kvX5kuzxo647P

Score

10^/10

raccoon 9ba64f4b6fe448911470a88f09d6e7d5b92ff0ab stealer

Malware Config

Extracted

Family

raccoon

Version

1.7.2

Botnet

9ba64f4b6fe448911470a88f09d6e7d5b92ff0ab

Attributes

url4cnc
https://telete.in/jagressor_kz

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1672-133-0x0000000000AD0000-0x0000000000B62000-memory.dmp	family_raccoon
behavioral2/memory/1672-134-0x0000000000400000-0x000000000087D000-memory.dmp	family_raccoon

Program crash 6 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4968	1672	WerFault.exe	ec3c75c8e1cb7e105ae92a9912afa6a5b887023fc8a7b50fdf56abcf8eb9fad1.exe
2724	1672	WerFault.exe	ec3c75c8e1cb7e105ae92a9912afa6a5b887023fc8a7b50fdf56abcf8eb9fad1.exe
4844	1672	WerFault.exe	ec3c75c8e1cb7e105ae92a9912afa6a5b887023fc8a7b50fdf56abcf8eb9fad1.exe
4720	1672	WerFault.exe	ec3c75c8e1cb7e105ae92a9912afa6a5b887023fc8a7b50fdf56abcf8eb9fad1.exe
1156	1672	WerFault.exe	ec3c75c8e1cb7e105ae92a9912afa6a5b887023fc8a7b50fdf56abcf8eb9fad1.exe
1060	1672	WerFault.exe	ec3c75c8e1cb7e105ae92a9912afa6a5b887023fc8a7b50fdf56abcf8eb9fad1.exe

C:\Users\Admin\AppData\Local\Temp\ec3c75c8e1cb7e105ae92a9912afa6a5b887023fc8a7b50fdf56abcf8eb9fad1.exe
"C:\Users\Admin\AppData\Local\Temp\ec3c75c8e1cb7e105ae92a9912afa6a5b887023fc8a7b50fdf56abcf8eb9fad1.exe"
1⤵
PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 740
2⤵
- Program crash
PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 760
2⤵
- Program crash
PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 768
2⤵
- Program crash
PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 768
2⤵
- Program crash
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 1056
2⤵
- Program crash
PID:1156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 1152
2⤵
- Program crash
PID:1060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1672 -ip 1672
1⤵
PID:1124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1672 -ip 1672
1⤵
PID:3816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1672 -ip 1672
1⤵
PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1672 -ip 1672
1⤵
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1672 -ip 1672
1⤵
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1672 -ip 1672
1⤵
PID:1652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-132-0x0000000000903000-0x0000000000953000-memory.dmp

Filesize
320KB

Download
memory/1672-133-0x0000000000AD0000-0x0000000000B62000-memory.dmp

Filesize
584KB

Download
memory/1672-134-0x0000000000400000-0x000000000087D000-memory.dmp

Filesize
4.5MB

Download
memory/1672-135-0x0000000000903000-0x0000000000953000-memory.dmp

Filesize
320KB

Download