Analysis
- max time kernel
143s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
02/10/2023, 20:12
General
- Target e6cf53ed54800ab07af736446dd66565.exe
- Size 227KB
- Sample231002-yytwlaee5s
- SHA256 f62d3ac335a3bff0698d08076dd7fb06c806706879fcf66bfc17a25eb7673fdf
Malware Config
Extracted
-
raccoon
-
9c05379df6f1d02ae49f9ee18aad8c17
-
http://5.78.80.43:8388/
Signatures
- Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
- Raccoon Stealer payload 3 IoCs
- Program crash 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6cf53ed54800ab07af736446dd66565.exe"C:\Users\Admin\AppData\Local\Temp\e6cf53ed54800ab07af736446dd66565.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 97402⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1540 -ip 15401⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1540-1-0x0000000002470000-0x0000000002570000-memory.dmp
memory/1540-2-0x0000000000400000-0x0000000002434000-memory.dmp
memory/1540-3-0x0000000002450000-0x000000000246A000-memory.dmp
memory/1540-4-0x0000000000400000-0x0000000002434000-memory.dmp
memory/1540-5-0x0000000002470000-0x0000000002570000-memory.dmp
memory/3204-8-0x0000019B10B40000-0x0000019B10B50000-memory.dmp
memory/3204-24-0x0000019B10C40000-0x0000019B10C50000-memory.dmp
memory/3204-40-0x0000019B18F70000-0x0000019B18F71000-memory.dmp
memory/3204-42-0x0000019B18FA0000-0x0000019B18FA1000-memory.dmp
memory/3204-43-0x0000019B18FA0000-0x0000019B18FA1000-memory.dmp
memory/3204-44-0x0000019B190B0000-0x0000019B190B1000-memory.dmp