raccoon | d973952bd7d8809520b745366a2c77245844a2f725f1b47347f86904d0049eb2

Analysis

max time kernel
111s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2023 22:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test2.exe
Size

393KB
MD5

8feee1abc1fccf5931f4ea3d34ec91c6
SHA1

402dd77cd78936c9e837f95bd730ac9c9e2e11a5
SHA256

d973952bd7d8809520b745366a2c77245844a2f725f1b47347f86904d0049eb2
SHA512

b90818dddfb23e345e9c387e1b4abbc6ee438cf3390acceffe746291ec4421251cb775052bf42a0c3fc449c140a0212b816b19fc8aca90b52e1973a2cf2c55dc
SSDEEP

12288:5XbYqmI6n2nXJvGN8pcHmxcMYw3Rvly9UISK1:5X8qqn2ZvOH7zw3cUIS

Score

10^/10

raccoon 8f650ec018d9fd14688866b3230c4641 stealer

Malware Config

Extracted

Family

raccoon

Botnet

8f650ec018d9fd14688866b3230c4641

http://147.78.47.232

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious use of SetThreadContext 1 IoCs

Processes:

test2.exe

description pid process target process

PID 1972 set thread context of 316 1972 test2.exe AddInProcess32.exe

description	pid	process	target process
PID 1972 set thread context of 316	1972	test2.exe	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

test2.exe

pid	process
1972	test2.exe
1972	test2.exe
1972	test2.exe
1972	test2.exe
1972	test2.exe
1972	test2.exe
1972	test2.exe
1972	test2.exe
1972	test2.exe
1972	test2.exe
1972	test2.exe
1972	test2.exe
1972	test2.exe
1972	test2.exe
1972	test2.exe
1972	test2.exe
1972	test2.exe
1972	test2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

test2.exe

description pid process

Token: SeDebugPrivilege 1972 test2.exe

description	pid	process
Token: SeDebugPrivilege	1972	test2.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

test2.exe

description	pid	process	target process
PID 1972 wrote to memory of 1848	1972	test2.exe	EdmGen.exe
PID 1972 wrote to memory of 1848	1972	test2.exe	EdmGen.exe
PID 1972 wrote to memory of 1788	1972	test2.exe	CasPol.exe
PID 1972 wrote to memory of 1788	1972	test2.exe	CasPol.exe
PID 1972 wrote to memory of 2820	1972	test2.exe	csc.exe
PID 1972 wrote to memory of 2820	1972	test2.exe	csc.exe
PID 1972 wrote to memory of 616	1972	test2.exe	aspnet_state.exe
PID 1972 wrote to memory of 616	1972	test2.exe	aspnet_state.exe
PID 1972 wrote to memory of 4432	1972	test2.exe	ComSvcConfig.exe
PID 1972 wrote to memory of 4432	1972	test2.exe	ComSvcConfig.exe
PID 1972 wrote to memory of 4544	1972	test2.exe	AddInUtil.exe
PID 1972 wrote to memory of 4544	1972	test2.exe	AddInUtil.exe
PID 1972 wrote to memory of 3144	1972	test2.exe	AppLaunch.exe
PID 1972 wrote to memory of 3144	1972	test2.exe	AppLaunch.exe
PID 1972 wrote to memory of 1656	1972	test2.exe	mscorsvw.exe
PID 1972 wrote to memory of 1656	1972	test2.exe	mscorsvw.exe
PID 1972 wrote to memory of 1648	1972	test2.exe	ngen.exe
PID 1972 wrote to memory of 1648	1972	test2.exe	ngen.exe
PID 1972 wrote to memory of 316	1972	test2.exe	AddInProcess32.exe
PID 1972 wrote to memory of 316	1972	test2.exe	AddInProcess32.exe
PID 1972 wrote to memory of 316	1972	test2.exe	AddInProcess32.exe
PID 1972 wrote to memory of 316	1972	test2.exe	AddInProcess32.exe
PID 1972 wrote to memory of 316	1972	test2.exe	AddInProcess32.exe
PID 1972 wrote to memory of 316	1972	test2.exe	AddInProcess32.exe
PID 1972 wrote to memory of 316	1972	test2.exe	AddInProcess32.exe
PID 1972 wrote to memory of 316	1972	test2.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\test2.exe
"C:\Users\Admin\AppData\Local\Temp\test2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
  2⤵
  PID:1848
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"
  2⤵
  PID:1788
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
  2⤵
  PID:2820
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
  2⤵
  PID:616
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
  2⤵
  PID:4432
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"
  2⤵
  PID:4544
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3144
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
  2⤵
  PID:1656
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
  2⤵
  PID:1648
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/316-135-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/316-138-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/316-139-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1972-133-0x0000019A79BD0000-0x0000019A79C36000-memory.dmp

Filesize
408KB

Download
memory/1972-134-0x0000019A7C200000-0x0000019A7C210000-memory.dmp

Filesize
64KB

Download