raccoon | b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5

Analysis

max time kernel
84s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2023 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rljanzfv-1.exe
Size

1.3MB
MD5

59d922ea8927648089227a1ffc5e700d
SHA1

901d55086adb3e9e16ad72f5c96d5e26d6efb7c6
SHA256

b98c25c9332c08071cdce0e2076000fc1c918b058af7bfd572724b1e86f8ecb5
SHA512

0c0f5b1ce4a0a5a6481ecf4f8bb879e3cb595242b65929e0e701d771c61a1fda9391d05c18414df7bcb00383deb25949d047cbde761ad0d3bbc27d0f261c0541
SSDEEP

24576:K3s4iZ53q2dqMBu37qRjWWprCycXa0dU:K

Score

10^/10

raccoon 071a7b18a42c1cd94de2fc5bb0bbcaf2 stealer

Malware Config

Extracted

Family

raccoon

Botnet

071a7b18a42c1cd94de2fc5bb0bbcaf2

http://85.209.134.122:80/

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1940-1065-0x0000000000400000-0x000000000040F000-memory.dmp	family_raccoon

Suspicious use of SetThreadContext 1 IoCs

Processes:

Rljanzfv-1.exe

description pid process target process

PID 464 set thread context of 1940 464 Rljanzfv-1.exe RegAsm.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Rljanzfv-1.exe

pid process

464 Rljanzfv-1.exe
464 Rljanzfv-1.exe
464 Rljanzfv-1.exe
464 Rljanzfv-1.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Rljanzfv-1.exe

description pid process

Token: SeDebugPrivilege 464 Rljanzfv-1.exe

description	pid	process	target process
PID 464 set thread context of 1940	464	Rljanzfv-1.exe	RegAsm.exe

pid	process
464	Rljanzfv-1.exe
464	Rljanzfv-1.exe
464	Rljanzfv-1.exe
464	Rljanzfv-1.exe

description	pid	process
Token: SeDebugPrivilege	464	Rljanzfv-1.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

Rljanzfv-1.exe

description	pid	process	target process
PID 464 wrote to memory of 4612	464	Rljanzfv-1.exe	RegAsm.exe
PID 464 wrote to memory of 4612	464	Rljanzfv-1.exe	RegAsm.exe
PID 464 wrote to memory of 4612	464	Rljanzfv-1.exe	RegAsm.exe
PID 464 wrote to memory of 3392	464	Rljanzfv-1.exe	RegAsm.exe
PID 464 wrote to memory of 3392	464	Rljanzfv-1.exe	RegAsm.exe
PID 464 wrote to memory of 3392	464	Rljanzfv-1.exe	RegAsm.exe
PID 464 wrote to memory of 1940	464	Rljanzfv-1.exe	RegAsm.exe
PID 464 wrote to memory of 1940	464	Rljanzfv-1.exe	RegAsm.exe
PID 464 wrote to memory of 1940	464	Rljanzfv-1.exe	RegAsm.exe
PID 464 wrote to memory of 1940	464	Rljanzfv-1.exe	RegAsm.exe
PID 464 wrote to memory of 1940	464	Rljanzfv-1.exe	RegAsm.exe
PID 464 wrote to memory of 1940	464	Rljanzfv-1.exe	RegAsm.exe
PID 464 wrote to memory of 1940	464	Rljanzfv-1.exe	RegAsm.exe
PID 464 wrote to memory of 1940	464	Rljanzfv-1.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\Rljanzfv-1.exe
"C:\Users\Admin\AppData\Local\Temp\Rljanzfv-1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  PID:4612
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  PID:3392
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  PID:1940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/464-133-0x0000000000E70000-0x0000000000FBC000-memory.dmp

Filesize
1.3MB

Download
memory/464-134-0x0000000005FF0000-0x0000000006594000-memory.dmp

Filesize
5.6MB

Download
memory/464-135-0x0000000005AE0000-0x0000000005B72000-memory.dmp

Filesize
584KB

Download
memory/464-136-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-137-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-139-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-141-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-143-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-145-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-147-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-149-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-151-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-153-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-155-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-157-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-159-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-161-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-163-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-165-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-167-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-169-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-171-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-173-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-175-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-177-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-179-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-181-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-183-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-185-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-187-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-189-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-191-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-193-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-195-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-197-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-199-0x00000000058F0000-0x0000000005991000-memory.dmp

Filesize
644KB

Download
memory/464-1058-0x0000000005A30000-0x0000000005A40000-memory.dmp

Filesize
64KB

Download
memory/464-1059-0x0000000005A50000-0x0000000005A51000-memory.dmp

Filesize
4KB

Download
memory/464-1060-0x0000000005D80000-0x0000000005DE6000-memory.dmp

Filesize
408KB

Download
memory/1940-1065-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download