raccoon | 9d05e8ef93511f02e7f0d270402b37658817a2d233f9cd12b40b87d4a4af7a77

Analysis

max time kernel
46s
max time network
57s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
09-07-2023 16:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d05e8ef93511f02e7f0d2704.exe
Size

3.5MB
MD5

7aa8353d95576dfdd42d2382ffe0e626
SHA1

9798cd96ca573c6f54fc84611cfc4a7802212dea
SHA256

9d05e8ef93511f02e7f0d270402b37658817a2d233f9cd12b40b87d4a4af7a77
SHA512

f536592a62c5b510f05dc05b866c59557a7246052605551d364c4c1a9d9f8b94f01dbd3cf8526e4a5bded4dd81791923f14f424310d712306b523c3aca8bbc64
SSDEEP

24576:yqCSpM9XJSnFTGkzgB3uz60e5Lb1HCfLSovTaCqbvF+WKzQqW/pt64Y5v7QHuHOa:yqCgHny3COVb1HCfLpv

Score

10^/10

raccoon fa72f4c1fbe65cee8651140fd47267ba stealer

Malware Config

Extracted

Family

raccoon

Botnet

fa72f4c1fbe65cee8651140fd47267ba

http://193.142.147.59:80

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3000-1390-0x0000000000400000-0x000000000040F000-memory.dmp	family_raccoon

Suspicious use of SetThreadContext 1 IoCs

Processes:

9d05e8ef93511f02e7f0d2704.exe

description pid process target process

PID 584 set thread context of 3000 584 9d05e8ef93511f02e7f0d2704.exe 9d05e8ef93511f02e7f0d2704.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

9d05e8ef93511f02e7f0d2704.exe

description pid process

Token: SeDebugPrivilege 584 9d05e8ef93511f02e7f0d2704.exe

description	pid	process	target process
PID 584 set thread context of 3000	584	9d05e8ef93511f02e7f0d2704.exe	9d05e8ef93511f02e7f0d2704.exe

description	pid	process
Token: SeDebugPrivilege	584	9d05e8ef93511f02e7f0d2704.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

9d05e8ef93511f02e7f0d2704.exe

description	pid	process	target process
PID 584 wrote to memory of 3000	584	9d05e8ef93511f02e7f0d2704.exe	9d05e8ef93511f02e7f0d2704.exe
PID 584 wrote to memory of 3000	584	9d05e8ef93511f02e7f0d2704.exe	9d05e8ef93511f02e7f0d2704.exe
PID 584 wrote to memory of 3000	584	9d05e8ef93511f02e7f0d2704.exe	9d05e8ef93511f02e7f0d2704.exe
PID 584 wrote to memory of 3000	584	9d05e8ef93511f02e7f0d2704.exe	9d05e8ef93511f02e7f0d2704.exe
PID 584 wrote to memory of 3000	584	9d05e8ef93511f02e7f0d2704.exe	9d05e8ef93511f02e7f0d2704.exe
PID 584 wrote to memory of 3000	584	9d05e8ef93511f02e7f0d2704.exe	9d05e8ef93511f02e7f0d2704.exe
PID 584 wrote to memory of 3000	584	9d05e8ef93511f02e7f0d2704.exe	9d05e8ef93511f02e7f0d2704.exe
PID 584 wrote to memory of 3000	584	9d05e8ef93511f02e7f0d2704.exe	9d05e8ef93511f02e7f0d2704.exe
PID 584 wrote to memory of 3000	584	9d05e8ef93511f02e7f0d2704.exe	9d05e8ef93511f02e7f0d2704.exe

C:\Users\Admin\AppData\Local\Temp\9d05e8ef93511f02e7f0d2704.exe
"C:\Users\Admin\AppData\Local\Temp\9d05e8ef93511f02e7f0d2704.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:584
- C:\Users\Admin\AppData\Local\Temp\9d05e8ef93511f02e7f0d2704.exe
  C:\Users\Admin\AppData\Local\Temp\9d05e8ef93511f02e7f0d2704.exe
  2⤵
  PID:3000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/584-54-0x0000000001180000-0x0000000001506000-memory.dmp

Filesize
3.5MB

Download
memory/584-55-0x0000000000C50000-0x0000000000D1E000-memory.dmp

Filesize
824KB

Download
memory/584-56-0x0000000004F60000-0x0000000004FA0000-memory.dmp

Filesize
256KB

Download
memory/584-57-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-58-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-60-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-62-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-64-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-66-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-68-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-70-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-72-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-74-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-76-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-82-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-96-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-94-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-92-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-90-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-88-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-86-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-84-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-80-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-78-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-98-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-100-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-102-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-104-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-106-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-108-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-110-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-112-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-114-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-116-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-118-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-120-0x0000000000C50000-0x0000000000D17000-memory.dmp

Filesize
796KB

Download
memory/584-1379-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/584-1380-0x0000000000640000-0x0000000000672000-memory.dmp

Filesize
200KB

Download
memory/584-1381-0x0000000000B50000-0x0000000000B9C000-memory.dmp

Filesize
304KB

Download
memory/3000-1390-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download