raccoon | 7089ad447bc518385d3858e983df63e7cb011e518beb4ed4117d7496a5fd28b1

Analysis

max time kernel
42s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-02-2023 10:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe
Size

830KB
MD5

bc46af138f661c31bd23dfed643aec0c
SHA1

db363d46dfb756f97c7cfb3b0be91d1af5200a6b
SHA256

a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828
SHA512

5c6171875162886b678daa1d4096b3c3ef0bc60fb83f7528c31eaa73c2def7adf4adb51cd858223690e9b684dce446811132bb8bfee5db78a478c77cc0b003c3
SSDEEP

24576:K2zMwwTlE32rV9AFLVGpMo5c+idrNtNNx8qR1g:3wTlOEsMK8c9dd4

Score

10^/10

raccoon cabcf15ea37a24b58186813d42a6971f stealer

Malware Config

Extracted

Family

raccoon

Botnet

cabcf15ea37a24b58186813d42a6971f

http://83.217.11.16/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Suspicious use of SetThreadContext 1 IoCs

Processes:

a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe

description	pid	process	target process
PID 1184 set thread context of 948	1184	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe

description	pid	process	target process
PID 1184 wrote to memory of 948	1184	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe
PID 1184 wrote to memory of 948	1184	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe
PID 1184 wrote to memory of 948	1184	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe
PID 1184 wrote to memory of 948	1184	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe
PID 1184 wrote to memory of 948	1184	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe
PID 1184 wrote to memory of 948	1184	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe
PID 1184 wrote to memory of 948	1184	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe
PID 1184 wrote to memory of 948	1184	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe
PID 1184 wrote to memory of 948	1184	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe

C:\Users\Admin\AppData\Local\Temp\a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe
"C:\Users\Admin\AppData\Local\Temp\a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1184

C:\Users\Admin\AppData\Local\Temp\a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe
"C:\Users\Admin\AppData\Local\Temp\a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe"
2⤵
PID:948

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/948-60-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/948-61-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/948-63-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/948-65-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/948-66-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/948-67-0x00000000004088ED-mapping.dmp

Download
memory/1184-54-0x0000000000880000-0x0000000000954000-memory.dmp

Filesize
848KB

Download
memory/1184-55-0x00000000767F1000-0x00000000767F3000-memory.dmp

Filesize
8KB

Download
memory/1184-56-0x0000000000290000-0x00000000002A6000-memory.dmp

Filesize
88KB

Download
memory/1184-57-0x00000000003F0000-0x00000000003FA000-memory.dmp

Filesize
40KB

Download
memory/1184-58-0x0000000004310000-0x000000000436A000-memory.dmp

Filesize
360KB

Download
memory/1184-59-0x0000000000650000-0x0000000000670000-memory.dmp

Filesize
128KB

Download