raccoon | b297a76de5182907a69a878cf161ca65b274152eb92a9d9591248ac4f5494dcf

Resubmissions

20-02-2023 05:44

230220-gflzlahc6w 10

Analysis

max time kernel
108s
max time network
36s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
20-02-2023 05:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup.exe
Size

438.2MB
MD5

5b1914a62235a396b7caed0b6625dd97
SHA1

c53b265f1101cc775cc591d312de6072fa53ce6e
SHA256

e5b78dd4d31d810e37a8b53d20c3351afe8e6186d90abd026d1d051a6e39ddeb
SHA512

fd6f81bac09781d52221fb86d7f2def9b8fb1df80dee6757c9865a86c9ce48edda0ab1d5e452fc4fa3ccb1658bc1d5cb7d30a76b7360c4bb77b311f1f1d5b208
SSDEEP

24576:IGp1/PD9pD6b3ewHdqoTL2lWA7QUgVs1bFBpWvyf7:IGpVPDSb/XL2lWmQRzI7

Score

10^/10

raccoon ae72a9288d2ce774d14ddadddb8258c1 stealer

Malware Config

Extracted

Family

raccoon

Botnet

ae72a9288d2ce774d14ddadddb8258c1

http://83.217.11.11/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Suspicious use of SetThreadContext 3 IoCs

Processes:

Setup.exeSetup.exeSetup.exe

description	pid	process	target process
PID 1288 set thread context of 876	1288	Setup.exe	Setup.exe
PID 1716 set thread context of 1540	1716	Setup.exe	Setup.exe
PID 1936 set thread context of 604	1936	Setup.exe	Setup.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1804	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1804	AUDIODG.EXE
Token: 33	1804	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1804	AUDIODG.EXE

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

Setup.exeSetup.exeSetup.exe

description	pid	process	target process
PID 1288 wrote to memory of 876	1288	Setup.exe	Setup.exe
PID 1288 wrote to memory of 876	1288	Setup.exe	Setup.exe
PID 1288 wrote to memory of 876	1288	Setup.exe	Setup.exe
PID 1288 wrote to memory of 876	1288	Setup.exe	Setup.exe
PID 1288 wrote to memory of 876	1288	Setup.exe	Setup.exe
PID 1288 wrote to memory of 876	1288	Setup.exe	Setup.exe
PID 1288 wrote to memory of 876	1288	Setup.exe	Setup.exe
PID 1288 wrote to memory of 876	1288	Setup.exe	Setup.exe
PID 1288 wrote to memory of 876	1288	Setup.exe	Setup.exe
PID 1288 wrote to memory of 876	1288	Setup.exe	Setup.exe
PID 1288 wrote to memory of 876	1288	Setup.exe	Setup.exe
PID 1288 wrote to memory of 876	1288	Setup.exe	Setup.exe
PID 1716 wrote to memory of 1540	1716	Setup.exe	Setup.exe
PID 1716 wrote to memory of 1540	1716	Setup.exe	Setup.exe
PID 1716 wrote to memory of 1540	1716	Setup.exe	Setup.exe
PID 1716 wrote to memory of 1540	1716	Setup.exe	Setup.exe
PID 1716 wrote to memory of 1540	1716	Setup.exe	Setup.exe
PID 1716 wrote to memory of 1540	1716	Setup.exe	Setup.exe
PID 1716 wrote to memory of 1540	1716	Setup.exe	Setup.exe
PID 1716 wrote to memory of 1540	1716	Setup.exe	Setup.exe
PID 1716 wrote to memory of 1540	1716	Setup.exe	Setup.exe
PID 1716 wrote to memory of 1540	1716	Setup.exe	Setup.exe
PID 1716 wrote to memory of 1540	1716	Setup.exe	Setup.exe
PID 1716 wrote to memory of 1540	1716	Setup.exe	Setup.exe
PID 1936 wrote to memory of 604	1936	Setup.exe	Setup.exe
PID 1936 wrote to memory of 604	1936	Setup.exe	Setup.exe
PID 1936 wrote to memory of 604	1936	Setup.exe	Setup.exe
PID 1936 wrote to memory of 604	1936	Setup.exe	Setup.exe
PID 1936 wrote to memory of 604	1936	Setup.exe	Setup.exe
PID 1936 wrote to memory of 604	1936	Setup.exe	Setup.exe
PID 1936 wrote to memory of 604	1936	Setup.exe	Setup.exe
PID 1936 wrote to memory of 604	1936	Setup.exe	Setup.exe
PID 1936 wrote to memory of 604	1936	Setup.exe	Setup.exe
PID 1936 wrote to memory of 604	1936	Setup.exe	Setup.exe
PID 1936 wrote to memory of 604	1936	Setup.exe	Setup.exe
PID 1936 wrote to memory of 604	1936	Setup.exe	Setup.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1288

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
2⤵
PID:876

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1116

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1804

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1716

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
2⤵
PID:1540

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1936

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
2⤵
PID:604

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/604-88-0x00000000004088ED-mapping.dmp

Download
memory/876-62-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/876-68-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/876-69-0x00000000004088ED-mapping.dmp

Download
memory/876-67-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/876-65-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/876-63-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1116-57-0x000007FEFBD11000-0x000007FEFBD13000-memory.dmp

Filesize
8KB

Download
memory/1288-61-0x0000000000A10000-0x0000000000A56000-memory.dmp

Filesize
280KB

Download
memory/1288-60-0x00000000056E0000-0x000000000575E000-memory.dmp

Filesize
504KB

Download
memory/1288-59-0x0000000000500000-0x000000000050A000-memory.dmp

Filesize
40KB

Download
memory/1288-54-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download
memory/1288-56-0x00000000004E0000-0x00000000004F6000-memory.dmp

Filesize
88KB

Download
memory/1288-55-0x0000000001050000-0x0000000001168000-memory.dmp

Filesize
1.1MB

Download
memory/1540-79-0x00000000004088ED-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads