raccoon | d973952bd7d8809520b745366a2c77245844a2f725f1b47347f86904d0049eb2

General

Target

test2.exe
Size

393KB
MD5

8feee1abc1fccf5931f4ea3d34ec91c6
SHA1

402dd77cd78936c9e837f95bd730ac9c9e2e11a5
SHA256

d973952bd7d8809520b745366a2c77245844a2f725f1b47347f86904d0049eb2
SHA512

b90818dddfb23e345e9c387e1b4abbc6ee438cf3390acceffe746291ec4421251cb775052bf42a0c3fc449c140a0212b816b19fc8aca90b52e1973a2cf2c55dc
SSDEEP

12288:5XbYqmI6n2nXJvGN8pcHmxcMYw3Rvly9UISK1:5X8qqn2ZvOH7zw3cUIS

Score

10^/10

raccoon 8f650ec018d9fd14688866b3230c4641 stealer

Malware Config

Extracted

Family

raccoon

Botnet

8f650ec018d9fd14688866b3230c4641

C2

http://147.78.47.232

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious use of SetThreadContext 1 IoCs

Processes:

test2.exe

description pid process target process

PID 3532 set thread context of 1048 3532 test2.exe jsc.exe

description	pid	process	target process
PID 3532 set thread context of 1048	3532	test2.exe	jsc.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

test2.exe

pid	process
3532	test2.exe
3532	test2.exe
3532	test2.exe
3532	test2.exe
3532	test2.exe
3532	test2.exe
3532	test2.exe
3532	test2.exe
3532	test2.exe
3532	test2.exe
3532	test2.exe
3532	test2.exe
3532	test2.exe
3532	test2.exe
3532	test2.exe
3532	test2.exe
3532	test2.exe
3532	test2.exe
3532	test2.exe
3532	test2.exe
3532	test2.exe
3532	test2.exe
3532	test2.exe
3532	test2.exe
3532	test2.exe
3532	test2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

test2.exe

description pid process

Token: SeDebugPrivilege 3532 test2.exe

description	pid	process
Token: SeDebugPrivilege	3532	test2.exe

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

test2.exe

description	pid	process	target process
PID 3532 wrote to memory of 4856	3532	test2.exe	WsatConfig.exe
PID 3532 wrote to memory of 4856	3532	test2.exe	WsatConfig.exe
PID 3532 wrote to memory of 1088	3532	test2.exe	AppLaunch.exe
PID 3532 wrote to memory of 1088	3532	test2.exe	AppLaunch.exe
PID 3532 wrote to memory of 2888	3532	test2.exe	aspnet_state.exe
PID 3532 wrote to memory of 2888	3532	test2.exe	aspnet_state.exe
PID 3532 wrote to memory of 1740	3532	test2.exe	Microsoft.Workflow.Compiler.exe
PID 3532 wrote to memory of 1740	3532	test2.exe	Microsoft.Workflow.Compiler.exe
PID 3532 wrote to memory of 1788	3532	test2.exe	MSBuild.exe
PID 3532 wrote to memory of 1788	3532	test2.exe	MSBuild.exe
PID 3532 wrote to memory of 1416	3532	test2.exe	CasPol.exe
PID 3532 wrote to memory of 1416	3532	test2.exe	CasPol.exe
PID 3532 wrote to memory of 3048	3532	test2.exe	cvtres.exe
PID 3532 wrote to memory of 3048	3532	test2.exe	cvtres.exe
PID 3532 wrote to memory of 1428	3532	test2.exe	ilasm.exe
PID 3532 wrote to memory of 1428	3532	test2.exe	ilasm.exe
PID 3532 wrote to memory of 1384	3532	test2.exe	RegSvcs.exe
PID 3532 wrote to memory of 1384	3532	test2.exe	RegSvcs.exe
PID 3532 wrote to memory of 3156	3532	test2.exe	InstallUtil.exe
PID 3532 wrote to memory of 3156	3532	test2.exe	InstallUtil.exe
PID 3532 wrote to memory of 1096	3532	test2.exe	EdmGen.exe
PID 3532 wrote to memory of 1096	3532	test2.exe	EdmGen.exe
PID 3532 wrote to memory of 1332	3532	test2.exe	AddInProcess.exe
PID 3532 wrote to memory of 1332	3532	test2.exe	AddInProcess.exe
PID 3532 wrote to memory of 3160	3532	test2.exe	DataSvcUtil.exe
PID 3532 wrote to memory of 3160	3532	test2.exe	DataSvcUtil.exe
PID 3532 wrote to memory of 1048	3532	test2.exe	jsc.exe
PID 3532 wrote to memory of 1048	3532	test2.exe	jsc.exe
PID 3532 wrote to memory of 1048	3532	test2.exe	jsc.exe
PID 3532 wrote to memory of 1048	3532	test2.exe	jsc.exe
PID 3532 wrote to memory of 1048	3532	test2.exe	jsc.exe
PID 3532 wrote to memory of 1048	3532	test2.exe	jsc.exe
PID 3532 wrote to memory of 1048	3532	test2.exe	jsc.exe
PID 3532 wrote to memory of 1048	3532	test2.exe	jsc.exe

C:\Users\Admin\AppData\Local\Temp\test2.exe
"C:\Users\Admin\AppData\Local\Temp\test2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3532

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
2⤵
PID:4856

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
2⤵
PID:1088

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
2⤵
PID:2888

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"
2⤵
PID:1740

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
2⤵
PID:1788

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"
2⤵
PID:1416

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
2⤵
PID:3048

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"
2⤵
PID:1428

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
2⤵
PID:3156

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
2⤵
PID:1384

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
2⤵
PID:1096

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
2⤵
PID:1332

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"
2⤵
PID:3160

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
2⤵
PID:1048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-135-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1048-138-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1048-139-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3532-133-0x00000291DD2E0000-0x00000291DD346000-memory.dmp

Filesize
408KB

Download
memory/3532-134-0x00000291DEEE0000-0x00000291DEEF0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing