raccoon | ac09bb755ba44fe491ef0505d567a4b131a5e51c9d9129773f3d783547edfc98

Analysis

max time kernel
83s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2023 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe
Size

1.3MB
MD5

59d922ea8927648089227a1ffc5e700d
SHA1

901d55086adb3e9e16ad72f5c96d5e26d6efb7c6
SHA256

b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5
SHA512

0c0f5b1ce4a0a5a6481ecf4f8bb879e3cb595242b65929e0e701d771c61a1fda9391d05c18414df7bcb00383deb25949d047cbde761ad0d3bbc27d0f261c0541
SSDEEP

24576:K3s4iZ53q2dqMBu37qRjWWprCycXa0dU:K

Score

10^/10

raccoon stealer

Malware Config

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2204-1065-0x0000000000400000-0x000000000040F000-memory.dmp	family_raccoon

Suspicious use of SetThreadContext 1 IoCs

Processes:

b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe

description	pid	process	target process
PID 4172 set thread context of 2204	4172	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe

pid	process
4172	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe
4172	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe
4172	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe
4172	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe

description pid process

Token: SeDebugPrivilege 4172 b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe

description	pid	process
Token: SeDebugPrivilege	4172	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe

description	pid	process	target process
PID 4172 wrote to memory of 4288	4172	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe
PID 4172 wrote to memory of 4288	4172	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe
PID 4172 wrote to memory of 4288	4172	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe
PID 4172 wrote to memory of 4900	4172	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe
PID 4172 wrote to memory of 4900	4172	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe
PID 4172 wrote to memory of 4900	4172	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe
PID 4172 wrote to memory of 2204	4172	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe
PID 4172 wrote to memory of 2204	4172	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe
PID 4172 wrote to memory of 2204	4172	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe
PID 4172 wrote to memory of 2204	4172	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe
PID 4172 wrote to memory of 2204	4172	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe
PID 4172 wrote to memory of 2204	4172	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe
PID 4172 wrote to memory of 2204	4172	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe
PID 4172 wrote to memory of 2204	4172	b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe
"C:\Users\Admin\AppData\Local\Temp\b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  PID:4288
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  PID:4900
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  PID:2204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2204-1065-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4172-169-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-197-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-136-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-137-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-139-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-141-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-143-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-145-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-147-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-149-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-151-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-153-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-155-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-171-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-159-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-161-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-163-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-165-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-1060-0x0000000004FF0000-0x0000000005056000-memory.dmp

Filesize
408KB

Download
memory/4172-135-0x0000000004D50000-0x0000000004DE2000-memory.dmp

Filesize
584KB

Download
memory/4172-157-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-173-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-175-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-177-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-179-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-181-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-183-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-185-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-187-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-189-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-191-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-193-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-195-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-133-0x00000000000E0000-0x000000000022C000-memory.dmp

Filesize
1.3MB

Download
memory/4172-199-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-1058-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/4172-1059-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

Filesize
4KB

Download
memory/4172-167-0x0000000004C00000-0x0000000004CA1000-memory.dmp

Filesize
644KB

Download
memory/4172-134-0x0000000005260000-0x0000000005804000-memory.dmp

Filesize
5.6MB

Download