raccoon | 9d05e8ef93511f02e7f0d270402b37658817a2d233f9cd12b40b87d4a4af7a77

Analysis

max time kernel
73s
max time network
80s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
09/07/2023, 11:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d05e8ef93511f02e7f0d2704.exe
Size

3.5MB
MD5

7aa8353d95576dfdd42d2382ffe0e626
SHA1

9798cd96ca573c6f54fc84611cfc4a7802212dea
SHA256

9d05e8ef93511f02e7f0d270402b37658817a2d233f9cd12b40b87d4a4af7a77
SHA512

f536592a62c5b510f05dc05b866c59557a7246052605551d364c4c1a9d9f8b94f01dbd3cf8526e4a5bded4dd81791923f14f424310d712306b523c3aca8bbc64
SSDEEP

24576:yqCSpM9XJSnFTGkzgB3uz60e5Lb1HCfLSovTaCqbvF+WKzQqW/pt64Y5v7QHuHOa:yqCgHny3COVb1HCfLpv

Score

10^/10

raccoon fa72f4c1fbe65cee8651140fd47267ba stealer

Malware Config

Extracted

Family

raccoon

Botnet

fa72f4c1fbe65cee8651140fd47267ba

http://193.142.147.59:80

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer payload 1 IoCs

resource	yara_rule
behavioral1/memory/948-1389-0x0000000000400000-0x000000000040F000-memory.dmp	family_raccoon

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3004 set thread context of 948	3004	9d05e8ef93511f02e7f0d2704.exe	29

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	9d05e8ef93511f02e7f0d2704.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 948	3004	9d05e8ef93511f02e7f0d2704.exe	29
PID 3004 wrote to memory of 948	3004	9d05e8ef93511f02e7f0d2704.exe	29
PID 3004 wrote to memory of 948	3004	9d05e8ef93511f02e7f0d2704.exe	29
PID 3004 wrote to memory of 948	3004	9d05e8ef93511f02e7f0d2704.exe	29
PID 3004 wrote to memory of 948	3004	9d05e8ef93511f02e7f0d2704.exe	29
PID 3004 wrote to memory of 948	3004	9d05e8ef93511f02e7f0d2704.exe	29
PID 3004 wrote to memory of 948	3004	9d05e8ef93511f02e7f0d2704.exe	29
PID 3004 wrote to memory of 948	3004	9d05e8ef93511f02e7f0d2704.exe	29
PID 3004 wrote to memory of 948	3004	9d05e8ef93511f02e7f0d2704.exe	29

C:\Users\Admin\AppData\Local\Temp\9d05e8ef93511f02e7f0d2704.exe
"C:\Users\Admin\AppData\Local\Temp\9d05e8ef93511f02e7f0d2704.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Local\Temp\9d05e8ef93511f02e7f0d2704.exe
  C:\Users\Admin\AppData\Local\Temp\9d05e8ef93511f02e7f0d2704.exe
  2⤵
  PID:948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/948-1389-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/3004-88-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-90-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-57-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-61-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-59-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-63-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-65-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-67-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-69-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-92-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-73-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-81-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-79-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-77-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-75-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-83-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-86-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/3004-54-0x0000000001340000-0x00000000016C6000-memory.dmp

Filesize
3.5MB

Download
memory/3004-56-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-85-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-71-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-94-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-100-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-102-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-98-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-108-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-110-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-106-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-104-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-96-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-112-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-114-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-120-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-118-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-116-0x0000000004AD0000-0x0000000004B97000-memory.dmp

Filesize
796KB

Download
memory/3004-1379-0x0000000000650000-0x0000000000682000-memory.dmp

Filesize
200KB

Download
memory/3004-1380-0x0000000000CC0000-0x0000000000D0C000-memory.dmp

Filesize
304KB

Download
memory/3004-55-0x0000000004AD0000-0x0000000004B9E000-memory.dmp

Filesize
824KB

Download