raccoon | d4224f288dd203d784301459d37aed4a0e908f53b7b60b83c4d7f2b65cc007d1

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 00:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0e10ea38b2c0569203a5f46efdec60dc.exe
Size

5.3MB
MD5

0e10ea38b2c0569203a5f46efdec60dc
SHA1

2a85e47f44d07d52a55095c78b42127e290c5069
SHA256

d4224f288dd203d784301459d37aed4a0e908f53b7b60b83c4d7f2b65cc007d1
SHA512

29e909457cfeb8de60a9eecc3aed132bb59a5bfae8e81c76c414a54b5638500adf839e3bf0f26ee56d9bad2084c34a04886d0d35a64eb8761f0cc8449bdb8f35
SSDEEP

49152:Z4VIxoeQOSWFdin2IVvjm/yw3mAa3/jFPP+EhEyh3cow384AEDiJUdoKtYlQuWpo:Z2IxoebxdOKW

Score

10^/10

raccoon 5ff7bc68b712d0b2c95bc2d831e79eaf stealer

Malware Config

Extracted

Family

raccoon

Botnet

5ff7bc68b712d0b2c95bc2d831e79eaf

http://45.15.156.141:80

Attributes

user_agent
SunShineMoonLight

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/2328-12-0x0000000000400000-0x000000000041B000-memory.dmp	family_raccoon
behavioral1/memory/2328-15-0x0000000000400000-0x000000000041B000-memory.dmp	family_raccoon
behavioral1/memory/2328-18-0x0000000000400000-0x000000000041B000-memory.dmp	family_raccoon
behavioral1/memory/2328-19-0x0000000000400000-0x000000000041B000-memory.dmp	family_raccoon

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programfiles.vbs	0e10ea38b2c0569203a5f46efdec60dc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1732 set thread context of 2328	1732	0e10ea38b2c0569203a5f46efdec60dc.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	0e10ea38b2c0569203a5f46efdec60dc.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2328	1732	0e10ea38b2c0569203a5f46efdec60dc.exe	28
PID 1732 wrote to memory of 2328	1732	0e10ea38b2c0569203a5f46efdec60dc.exe	28
PID 1732 wrote to memory of 2328	1732	0e10ea38b2c0569203a5f46efdec60dc.exe	28
PID 1732 wrote to memory of 2328	1732	0e10ea38b2c0569203a5f46efdec60dc.exe	28
PID 1732 wrote to memory of 2328	1732	0e10ea38b2c0569203a5f46efdec60dc.exe	28
PID 1732 wrote to memory of 2328	1732	0e10ea38b2c0569203a5f46efdec60dc.exe	28
PID 1732 wrote to memory of 2328	1732	0e10ea38b2c0569203a5f46efdec60dc.exe	28
PID 1732 wrote to memory of 2328	1732	0e10ea38b2c0569203a5f46efdec60dc.exe	28
PID 1732 wrote to memory of 2328	1732	0e10ea38b2c0569203a5f46efdec60dc.exe	28
PID 1732 wrote to memory of 2328	1732	0e10ea38b2c0569203a5f46efdec60dc.exe	28
PID 1732 wrote to memory of 2328	1732	0e10ea38b2c0569203a5f46efdec60dc.exe	28
PID 1732 wrote to memory of 2328	1732	0e10ea38b2c0569203a5f46efdec60dc.exe	28

C:\Users\Admin\AppData\Local\Temp\0e10ea38b2c0569203a5f46efdec60dc.exe
"C:\Users\Admin\AppData\Local\Temp\0e10ea38b2c0569203a5f46efdec60dc.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  PID:2328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1732-0-0x0000000001130000-0x0000000001280000-memory.dmp

Filesize
1.3MB

Download
memory/1732-1-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download
memory/1732-2-0x0000000000860000-0x00000000008A0000-memory.dmp

Filesize
256KB

Download
memory/1732-3-0x0000000000460000-0x00000000004A8000-memory.dmp

Filesize
288KB

Download
memory/1732-4-0x0000000000810000-0x0000000000856000-memory.dmp

Filesize
280KB

Download
memory/1732-5-0x0000000000CB0000-0x0000000000CE6000-memory.dmp

Filesize
216KB

Download
memory/1732-6-0x0000000000EC0000-0x0000000000F0C000-memory.dmp

Filesize
304KB

Download
memory/1732-17-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download
memory/2328-12-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2328-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2328-10-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2328-9-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2328-15-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2328-11-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2328-18-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2328-19-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download