raccoon | ec77d8e5e9ad405e74bc0780d1fd6b4070dfd155a0556ef3288ac493a1f28448

General

Target

43f13ec00b6df87637b5863be3ffe01fc85947a8918f567c1713dd8a4d6ba908.exe
Size

8.4MB
MD5

dcbe1dec97959e20853fd760b6900c01
SHA1

e8429524690350ca306badc5db81fa1e4c8becf1
SHA256

43f13ec00b6df87637b5863be3ffe01fc85947a8918f567c1713dd8a4d6ba908
SHA512

c27b6f7d2d15228dd7bf5ffb996b4e4c800758114fad653ea6107605b23d73184b78ef410eee422ea5668a431c949c913ae17ded5de2760f61b436336436b013
SSDEEP

98304:AnEzmlSLRyvNFTeM9jgDubUynvFq5xS8Rr7pLfZNlT3/Msj:AES2Ryv/TU6bnvARr77/Msj

Score

10^/10

raccoon 8fb7b851641d456f39570978e99f780e stealer

Malware Config

Extracted

Family

raccoon

Botnet

8fb7b851641d456f39570978e99f780e

C2

http://45.15.156.239/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

.NET Reactor proctector 34 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral2/memory/4720-133-0x0000000000280000-0x0000000000AF6000-memory.dmp	net_reactor
behavioral2/memory/4720-136-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-137-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-139-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-141-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-143-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-145-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-147-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-149-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-151-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-153-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-155-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-157-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-159-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-161-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-163-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-165-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-167-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-169-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-171-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-173-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-175-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-177-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-179-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-181-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-183-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-185-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-187-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-189-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-191-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-193-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-195-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-197-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor
behavioral2/memory/4720-199-0x0000000002BC0000-0x0000000002C48000-memory.dmp	net_reactor

Suspicious use of SetThreadContext 1 IoCs

Processes:

43f13ec00b6df87637b5863be3ffe01fc85947a8918f567c1713dd8a4d6ba908.exe

description	pid	process	target process
PID 4720 set thread context of 3936	4720	43f13ec00b6df87637b5863be3ffe01fc85947a8918f567c1713dd8a4d6ba908.exe	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

43f13ec00b6df87637b5863be3ffe01fc85947a8918f567c1713dd8a4d6ba908.exe

description pid process

Token: SeDebugPrivilege 4720 43f13ec00b6df87637b5863be3ffe01fc85947a8918f567c1713dd8a4d6ba908.exe

description	pid	process
Token: SeDebugPrivilege	4720	43f13ec00b6df87637b5863be3ffe01fc85947a8918f567c1713dd8a4d6ba908.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

43f13ec00b6df87637b5863be3ffe01fc85947a8918f567c1713dd8a4d6ba908.exe

description	pid	process	target process
PID 4720 wrote to memory of 3936	4720	43f13ec00b6df87637b5863be3ffe01fc85947a8918f567c1713dd8a4d6ba908.exe	InstallUtil.exe
PID 4720 wrote to memory of 3936	4720	43f13ec00b6df87637b5863be3ffe01fc85947a8918f567c1713dd8a4d6ba908.exe	InstallUtil.exe
PID 4720 wrote to memory of 3936	4720	43f13ec00b6df87637b5863be3ffe01fc85947a8918f567c1713dd8a4d6ba908.exe	InstallUtil.exe
PID 4720 wrote to memory of 3936	4720	43f13ec00b6df87637b5863be3ffe01fc85947a8918f567c1713dd8a4d6ba908.exe	InstallUtil.exe
PID 4720 wrote to memory of 3936	4720	43f13ec00b6df87637b5863be3ffe01fc85947a8918f567c1713dd8a4d6ba908.exe	InstallUtil.exe
PID 4720 wrote to memory of 3936	4720	43f13ec00b6df87637b5863be3ffe01fc85947a8918f567c1713dd8a4d6ba908.exe	InstallUtil.exe
PID 4720 wrote to memory of 3936	4720	43f13ec00b6df87637b5863be3ffe01fc85947a8918f567c1713dd8a4d6ba908.exe	InstallUtil.exe
PID 4720 wrote to memory of 3936	4720	43f13ec00b6df87637b5863be3ffe01fc85947a8918f567c1713dd8a4d6ba908.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\43f13ec00b6df87637b5863be3ffe01fc85947a8918f567c1713dd8a4d6ba908.exe
"C:\Users\Admin\AppData\Local\Temp\43f13ec00b6df87637b5863be3ffe01fc85947a8918f567c1713dd8a4d6ba908.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4720

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
PID:3936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3936-1604-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4720-165-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-137-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-163-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-133-0x0000000000280000-0x0000000000AF6000-memory.dmp

Filesize
8.5MB

Download
memory/4720-139-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-141-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-143-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-145-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-147-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-149-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-151-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-153-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-155-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-157-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-159-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-161-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-136-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-167-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-135-0x0000000001240000-0x0000000001241000-memory.dmp

Filesize
4KB

Download
memory/4720-169-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-171-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-173-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-175-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-177-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-179-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-181-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-183-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-185-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-187-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-189-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-191-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-193-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-195-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-197-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-199-0x0000000002BC0000-0x0000000002C48000-memory.dmp

Filesize
544KB

Download
memory/4720-134-0x000000001CE90000-0x000000001CEA0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads