Overview

overview

10

Static

static

BankStatem...46.xll

windows7-x64

7

BankStatem...46.xll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BankStatement-1675184346.xll

  • Size

    75KB

  • Sample

    230131-vmy5dshb88

  • MD5

    ab5f556f96d8899eb5f77be82419107f

  • SHA1

    65c9f27bee36e773a7db8a4ee4f5d77c126e570a

  • SHA256

    1e2ec32a10710dd484a69caa60bdacc87a3ab932e6a0316a799646a8d0517eff

  • SHA512

    ac5a719779ad0b6167a2a868eb72a0a3258bb2fe592486747a51c867d92544834a1840f8275a6069be3411badf6ab8e5fd74f0321a55b8939baaba35c36f66d8

  • SSDEEP

    1536:1GfKhE0XUKlOZ9p+Ut3hGy3Nr8dGAaUDBMQ:kChEuUKlOZTxt3hGwry/DBR

Score
10/10
raccoon470ed711dadd97d5f2669317d6d3ee7dstealer

Malware Config

Extracted

Language
xlm4.0
Source

Extracted

Family

raccoon

Botnet

470ed711dadd97d5f2669317d6d3ee7d

C2

http://102.130.113.39

rc4.plain

Targets

    • Target

      BankStatement-1675184346.xll

    • Size

      75KB

    • MD5

      ab5f556f96d8899eb5f77be82419107f

    • SHA1

      65c9f27bee36e773a7db8a4ee4f5d77c126e570a

    • SHA256

      1e2ec32a10710dd484a69caa60bdacc87a3ab932e6a0316a799646a8d0517eff

    • SHA512

      ac5a719779ad0b6167a2a868eb72a0a3258bb2fe592486747a51c867d92544834a1840f8275a6069be3411badf6ab8e5fd74f0321a55b8939baaba35c36f66d8

    • SSDEEP

      1536:1GfKhE0XUKlOZ9p+Ut3hGy3Nr8dGAaUDBMQ:kChEuUKlOZTxt3hGwry/DBR

    Score
    10/10
    raccoon470ed711dadd97d5f2669317d6d3ee7dstealer

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks