raccoon | 52f7559453685d0c3f7c133af17d39ae40b09f403b792e1065d2529a5b6c3992 | Triage

Analysis

max time kernel
100s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2023 14:36

Sharing

Report Analysis Logs

General

Target

file.exe
Size

1.1MB
MD5

849ca256b617969e263ac005d1657fee
SHA1

429e8f10e14fd11d7b15715689a86b1e4f0275c4
SHA256

52f7559453685d0c3f7c133af17d39ae40b09f403b792e1065d2529a5b6c3992
SHA512

f120471e04b0c2312fcb630874d314338e68488512ceeedc260312c4ba570b367f602e44c26a756c64e5f84e75f69c66643433f836a7be481a6e2f2cb74c2dc5
SSDEEP

6144:EhQs0F6/DrcrgG5WwO4dqAO0y/Qas3CKcgnTIxViT1qH0WUi+gCsoSvi:EhQsP/DrcrgcUGyngTIs1q5boSvi

Score

10^/10

raccoon b11c37ed36597cb6d2adb8b6280a6e12 stealer

Malware Config

Extracted

Family

raccoon

Botnet

b11c37ed36597cb6d2adb8b6280a6e12

C2

http://94.142.138.32

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 3964 set thread context of 1860 3964 file.exe InstallUtil.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1200 3964 WerFault.exe file.exe
388 3964 WerFault.exe file.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

file.exe

description	pid	process	target process
PID 3964 wrote to memory of 1860	3964	file.exe	InstallUtil.exe
PID 3964 wrote to memory of 1860	3964	file.exe	InstallUtil.exe
PID 3964 wrote to memory of 1860	3964	file.exe	InstallUtil.exe
PID 3964 wrote to memory of 1860	3964	file.exe	InstallUtil.exe
PID 3964 wrote to memory of 1860	3964	file.exe	InstallUtil.exe
PID 3964 wrote to memory of 1860	3964	file.exe	InstallUtil.exe
PID 3964 wrote to memory of 1860	3964	file.exe	InstallUtil.exe
PID 3964 wrote to memory of 1860	3964	file.exe	InstallUtil.exe
PID 3964 wrote to memory of 1860	3964	file.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3964

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 288
2⤵
- Program crash
PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 276
2⤵
- Program crash
PID:388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3964 -ip 3964
1⤵
PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3964 -ip 3964
1⤵
PID:4804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1860-133-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1860-135-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1860-136-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download