raccoon | ac09bb755ba44fe491ef0505d567a4b131a5e51c9d9129773f3d783547edfc98

Analysis

max time kernel
43s
max time network
56s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
23-06-2023 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe
Size

1.3MB
MD5

59d922ea8927648089227a1ffc5e700d
SHA1

901d55086adb3e9e16ad72f5c96d5e26d6efb7c6
SHA256

b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5
SHA512

0c0f5b1ce4a0a5a6481ecf4f8bb879e3cb595242b65929e0e701d771c61a1fda9391d05c18414df7bcb00383deb25949d047cbde761ad0d3bbc27d0f261c0541
SSDEEP

24576:K3s4iZ53q2dqMBu37qRjWWprCycXa0dU:K

Score

10^/10

raccoon stealer

Malware Config

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1760-991-0x0000000000400000-0x000000000040F000-memory.dmp	family_raccoon

Suspicious use of SetThreadContext 1 IoCs

Processes:

b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe

description	pid	process	target process
PID 1700 set thread context of 1760	1700	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe

description pid process

Token: SeDebugPrivilege 1700 b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe

description	pid	process
Token: SeDebugPrivilege	1700	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe

description	pid	process	target process
PID 1700 wrote to memory of 1760	1700	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe
PID 1700 wrote to memory of 1760	1700	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe
PID 1700 wrote to memory of 1760	1700	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe
PID 1700 wrote to memory of 1760	1700	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe
PID 1700 wrote to memory of 1760	1700	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe
PID 1700 wrote to memory of 1760	1700	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe
PID 1700 wrote to memory of 1760	1700	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe
PID 1700 wrote to memory of 1760	1700	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe
PID 1700 wrote to memory of 1760	1700	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe
PID 1700 wrote to memory of 1760	1700	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe
PID 1700 wrote to memory of 1760	1700	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe
PID 1700 wrote to memory of 1760	1700	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe
"C:\Users\Admin\AppData\Local\Temp\b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  PID:1760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1700-54-0x0000000000C80000-0x0000000000DCC000-memory.dmp

Filesize
1.3MB

Download
memory/1700-55-0x00000000041D0000-0x0000000004276000-memory.dmp

Filesize
664KB

Download
memory/1700-56-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-57-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-59-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-61-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-63-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-65-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-67-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-69-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-71-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-73-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-75-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-77-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-79-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-81-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-83-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-85-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-87-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-91-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-93-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-89-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-95-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-97-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-99-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-101-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-105-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-103-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-109-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-107-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-111-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-117-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-115-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-113-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-119-0x00000000041D0000-0x0000000004271000-memory.dmp

Filesize
644KB

Download
memory/1700-978-0x0000000000A60000-0x0000000000A92000-memory.dmp

Filesize
200KB

Download
memory/1700-979-0x0000000004710000-0x000000000475C000-memory.dmp

Filesize
304KB

Download
memory/1700-981-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/1700-980-0x00000000049C0000-0x0000000004A00000-memory.dmp

Filesize
256KB

Download
memory/1760-991-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download