raccoon | db0270b977bf68fb8ce2e161bae88c7dd4ed82866b3bbc3d6c8a713edc69db53

General

Target

chatgpt.exe
Size

658.8MB
MD5

d3fbcca7d5fd818a9f1004c4e6b95fe3
SHA1

1487d9dfcaf863e279f9830affb851f3e9688d08
SHA256

5ff4a408a6578451248d8d7a5a9be2c75162f5406b143df9f46b83e30fa63226
SHA512

3accd3a3fb7697c602f1fc3601560a23f3bfd910c8cd5154b3130aa40230494b17c7b6962dce28e74be06df696433425bd5e0e7f6325eb44458644779134d361
SSDEEP

12288:7p/5R0g6QwlJRGLAIBcosKn7SJ1chc3wZbM2XhGcmOZMDomIoH3LdrscwZ6VHZY+:7x6n7RGhBcosKn701wXV1q

Score

10^/10

raccoon ff85621b9b7e77782fcfd9e75aa2a3e1 stealer

Malware Config

Extracted

Family

raccoon

Botnet

ff85621b9b7e77782fcfd9e75aa2a3e1

C2

http://80.85.139.245/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

41 1352 powershell.exe

flow	pid	process
41	1352	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs

Processes:

powershell.exe

pid	process
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 1352 set thread context of 1180 1352 powershell.exe aspnet_compiler.exe

description	pid	process	target process
PID 1352 set thread context of 1180	1352	powershell.exe	aspnet_compiler.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exe

pid	process
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe
1352	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1352 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1352	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

chatgpt.exepowershell.exe

description	pid	process	target process
PID 3876 wrote to memory of 1352	3876	chatgpt.exe	powershell.exe
PID 3876 wrote to memory of 1352	3876	chatgpt.exe	powershell.exe
PID 3876 wrote to memory of 1352	3876	chatgpt.exe	powershell.exe
PID 1352 wrote to memory of 4300	1352	powershell.exe	aspnet_compiler.exe
PID 1352 wrote to memory of 4300	1352	powershell.exe	aspnet_compiler.exe
PID 1352 wrote to memory of 4300	1352	powershell.exe	aspnet_compiler.exe
PID 1352 wrote to memory of 1816	1352	powershell.exe	aspnet_compiler.exe
PID 1352 wrote to memory of 1816	1352	powershell.exe	aspnet_compiler.exe
PID 1352 wrote to memory of 1816	1352	powershell.exe	aspnet_compiler.exe
PID 1352 wrote to memory of 1180	1352	powershell.exe	aspnet_compiler.exe
PID 1352 wrote to memory of 1180	1352	powershell.exe	aspnet_compiler.exe
PID 1352 wrote to memory of 1180	1352	powershell.exe	aspnet_compiler.exe
PID 1352 wrote to memory of 1180	1352	powershell.exe	aspnet_compiler.exe
PID 1352 wrote to memory of 1180	1352	powershell.exe	aspnet_compiler.exe
PID 1352 wrote to memory of 1180	1352	powershell.exe	aspnet_compiler.exe
PID 1352 wrote to memory of 1180	1352	powershell.exe	aspnet_compiler.exe
PID 1352 wrote to memory of 1180	1352	powershell.exe	aspnet_compiler.exe

C:\Users\Admin\AppData\Local\Temp\chatgpt.exe
"C:\Users\Admin\AppData\Local\Temp\chatgpt.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3876

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell.exe"
2⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1352

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
C:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe
3⤵
PID:4300

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
C:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe
3⤵
PID:1816

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
C:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe
3⤵
PID:1180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1180-149-0x0000000000000000-mapping.dmp

Download
memory/1180-153-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1180-152-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1180-150-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1352-142-0x00000000063B0000-0x00000000063CE000-memory.dmp

Filesize
120KB

Download
memory/1352-145-0x0000000007DB0000-0x000000000842A000-memory.dmp

Filesize
6.5MB

Download
memory/1352-138-0x00000000055A0000-0x0000000005BC8000-memory.dmp

Filesize
6.2MB

Download
memory/1352-139-0x00000000054E0000-0x0000000005502000-memory.dmp

Filesize
136KB

Download
memory/1352-140-0x0000000005CC0000-0x0000000005D26000-memory.dmp

Filesize
408KB

Download
memory/1352-141-0x0000000005DA0000-0x0000000005E06000-memory.dmp

Filesize
408KB

Download
memory/1352-136-0x0000000000000000-mapping.dmp

Download
memory/1352-143-0x0000000006930000-0x0000000006974000-memory.dmp

Filesize
272KB

Download
memory/1352-144-0x00000000076B0000-0x0000000007726000-memory.dmp

Filesize
472KB

Download
memory/1352-137-0x0000000002AA0000-0x0000000002AD6000-memory.dmp

Filesize
216KB

Download
memory/1352-146-0x0000000007750000-0x000000000776A000-memory.dmp

Filesize
104KB

Download
memory/1816-148-0x0000000000000000-mapping.dmp

Download
memory/3876-132-0x00000000002F0000-0x000000000037A000-memory.dmp

Filesize
552KB

Download
memory/3876-135-0x0000000004D30000-0x0000000004D3A000-memory.dmp

Filesize
40KB

Download
memory/3876-134-0x0000000004DB0000-0x0000000004E42000-memory.dmp

Filesize
584KB

Download
memory/3876-133-0x00000000052C0000-0x0000000005864000-memory.dmp

Filesize
5.6MB

Download
memory/4300-147-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads