raccoon | c9ff159b826661ea2361ee7a5ddb7fe27c036e9906f93cc302e4ed8851f4fffa

Analysis

max time kernel
124s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2023, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
13c439f2aa37547fcd115cf3e134dc39.exe
Size 1.2MB
Sample231024-2h8llaba99
SHA256 c9ff159b826661ea2361ee7a5ddb7fe27c036e9906f93cc302e4ed8851f4fffa
MD5 13c439f2aa37547fcd115cf3e134dc39
SHA1 efed6e321f531c6c38c742b1a86472795a478d71
SHA512 94a63dd5f2e28c41059a3a07c700e715e775b48bf30b1a2dfc0514ae98db3b576ba4eec2fe07e98c161d5c862969e318c046c78f746f4886d06e9ed6f4492be8
SSDEEP 24576:oDKMNt8ifoRO+16tg8UNkPaguM8JKwlghk+s:oDKs8vIsT+I7g8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

raccoon 48576d61a017d3386d2f0c737f3ea0e2 stealer

Malware Config

Extracted

Family

raccoon

Botnet

48576d61a017d3386d2f0c737f3ea0e2

http://62.113.119.179:80/

Attributes

user_agent
SunShineMoonLight

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer payload 2 IoCs

resource	yara_rule
behavioral2/memory/4628-32-0x0000000000400000-0x000000000041B000-memory.dmp	family_raccoon
behavioral2/memory/4628-34-0x0000000000400000-0x000000000041B000-memory.dmp	family_raccoon

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3360 created 3304	3360	Rn.pif	31

Executes dropped EXE 2 IoCs

pid	Process
3360	Rn.pif
4628	Rn.pif

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3360 set thread context of 4628	3360	Rn.pif	97

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1708	tasklist.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4952	PING.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3360	Rn.pif
3360	Rn.pif
3360	Rn.pif
3360	Rn.pif
3360	Rn.pif
3360	Rn.pif
3360	Rn.pif
3360	Rn.pif
3360	Rn.pif
3360	Rn.pif

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3360	Rn.pif
3360	Rn.pif
3360	Rn.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3360	Rn.pif
3360	Rn.pif
3360	Rn.pif

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 2016	2812	13c439f2aa37547fcd115cf3e134dc39.exe	85
PID 2812 wrote to memory of 2016	2812	13c439f2aa37547fcd115cf3e134dc39.exe	85
PID 2812 wrote to memory of 2016	2812	13c439f2aa37547fcd115cf3e134dc39.exe	85
PID 2016 wrote to memory of 4656	2016	cmd.exe	87
PID 2016 wrote to memory of 4656	2016	cmd.exe	87
PID 2016 wrote to memory of 4656	2016	cmd.exe	87
PID 4656 wrote to memory of 1708	4656	cmd.exe	88
PID 4656 wrote to memory of 1708	4656	cmd.exe	88
PID 4656 wrote to memory of 1708	4656	cmd.exe	88
PID 4656 wrote to memory of 2124	4656	cmd.exe	89
PID 4656 wrote to memory of 2124	4656	cmd.exe	89
PID 4656 wrote to memory of 2124	4656	cmd.exe	89
PID 4656 wrote to memory of 1944	4656	cmd.exe	91
PID 4656 wrote to memory of 1944	4656	cmd.exe	91
PID 4656 wrote to memory of 1944	4656	cmd.exe	91
PID 4656 wrote to memory of 4448	4656	cmd.exe	92
PID 4656 wrote to memory of 4448	4656	cmd.exe	92
PID 4656 wrote to memory of 4448	4656	cmd.exe	92
PID 4656 wrote to memory of 3360	4656	cmd.exe	93
PID 4656 wrote to memory of 3360	4656	cmd.exe	93
PID 4656 wrote to memory of 3360	4656	cmd.exe	93
PID 4656 wrote to memory of 4952	4656	cmd.exe	94
PID 4656 wrote to memory of 4952	4656	cmd.exe	94
PID 4656 wrote to memory of 4952	4656	cmd.exe	94
PID 3360 wrote to memory of 4628	3360	Rn.pif	97
PID 3360 wrote to memory of 4628	3360	Rn.pif	97
PID 3360 wrote to memory of 4628	3360	Rn.pif	97
PID 3360 wrote to memory of 4628	3360	Rn.pif	97
PID 3360 wrote to memory of 4628	3360	Rn.pif	97

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3304
- C:\Users\Admin\AppData\Local\Temp\13c439f2aa37547fcd115cf3e134dc39.exe
  "C:\Users\Admin\AppData\Local\Temp\13c439f2aa37547fcd115cf3e134dc39.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\SysWOW64\cmd.exe
    cmd /k cmd < Lid & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Windows\SysWOW64\cmd.exe
      cmd
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4656
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1708
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
        5⤵
        
        PID:2124
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c mkdir 6139
        5⤵
        
        PID:1944
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b Collected + Desirable + Lived + Echo + Jesse + Detail + Luck + Path + Ul 6139\Rn.pif
        5⤵
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\10511\6139\Rn.pif
        
        6139\Rn.pif 6139\e
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3360
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 5 localhost
        5⤵
        Runs ping.exe
        
        PID:4952
- C:\Users\Admin\AppData\Local\Temp\10511\6139\Rn.pif
  C:\Users\Admin\AppData\Local\Temp\10511\6139\Rn.pif
  2⤵
  - Executes dropped EXE
  PID:4628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rn.pif

Path C:\Users\Admin\AppData\Local\Temp\10511\6139\Rn.pif
Size 924KB
SHA256 f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
MD5 848164d084384c49937f99d5b894253e
SHA1 3055ef803eeec4f175ebf120f94125717ee12444
SHA512 aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a
SSDEEP 24576:LOo8pEnK4mrqlEZuVZ2HOI+X0l1lMZyYFaeBmyF:LF8p4KpqlEZeXI+X0TVcae3F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Rn.pif

Path C:\Users\Admin\AppData\Local\Temp\10511\6139\Rn.pif
Size 924KB
SHA256 f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
MD5 848164d084384c49937f99d5b894253e
SHA1 3055ef803eeec4f175ebf120f94125717ee12444
SHA512 aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a
SSDEEP 24576:LOo8pEnK4mrqlEZuVZ2HOI+X0l1lMZyYFaeBmyF:LF8p4KpqlEZeXI+X0TVcae3F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Collected

Path C:\Users\Admin\AppData\Local\Temp\10511\Collected
Size 171KB
SHA256 b5044d1bb591355fb982e06d66318e9fdb671da9d7e023684853257a1fc565e0
MD5 c1e77e08b3cf4430fb624a055b813a8b
SHA1 0749cb8a3fb4d88e4548d81b09b14b8c69c4248b
SHA512 18599ed6272f72fb8968331bb8bac960ff0f2ecdbb047dd1b913a912aa5d03eeaa26a669c72c79426de7b24888e8f5b240e8f66ec95456fc602f81cd3bdf9077
SSDEEP 3072:pPpU08BjlWTPJth26X7Sn4UfpLUNN9t68cCWlrss4M5iRq3U0Pe3vHU4n:LQBk7JjX74cN0lrztgwU0WH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Desirable

Path C:\Users\Admin\AppData\Local\Temp\10511\Desirable
Size 44KB
SHA256 a33fd77236a72d33ca59c996ca41d5ac510d2f4dd234abb1cb8168d615df465c
MD5 a213bd35a4db860fb70e3075b19e0115
SHA1 e6e757480ba860951d8f6e298eae5f88e6eddf12
SHA512 90bb3c2055ca24e069dc6a3b843fb552fa234e05fc4f64ae400acda68d3b603a3c1effde163454ec0483dcb72e62263744d7b70095a6d60f404c8fff7b8d97c7
SSDEEP 768:dI8rUL4g8Z/ff33ZIOiILuTjuGfFVZebxdS/tgB5l6y2fKS+wBDNwmoJd82J0Ad7:S4/33SrF7etdlf8rfKE5Km4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Detail

Path C:\Users\Admin\AppData\Local\Temp\10511\Detail
Size 1024B
SHA256 94ede6cc0f74d17b1d04be0e76d95d3cb246fdeeef5cca2d1347df26f0d79a9f
MD5 143d6de55518be2a15d3b95193e739b3
SHA1 174e689a2d41d12a1928ff6a908a623af2f09827
SHA512 a82805bed99eb0c859bc5b602fe203e961befafe6362beb60344bc6606f1d23a68d4bd163f615adae11b434d83c11d7baf5273af2686c67a041ba5267e09af1f
MD5 SHA1 SHA512

Submit Download

Echo

Path C:\Users\Admin\AppData\Local\Temp\10511\Echo
Size 161KB
SHA256 01d389f05324e907bc89d1b22934855d8964e409c76b93247012c2cdaa223b4a
MD5 9b9dd04a8d0018394155e715c1fa5516
SHA1 d990a2f008e5d3e6202ad21967c675f64c280518
SHA512 2b923739b8c82adc2d96157c8cf3fbd4bc557dc9e2d767a9ebbf01c27b600b86021d74e5757549f0cfce4e147e9104204079a73fc43de964885877c4c7bc8b59
SSDEEP 3072:sLWysRIO7vHZnBfzHl8Dz5YaZYvlfA6Gfza6iyY5tVGvH7fsUQwHJJXD:/b5nZ2tZ6lfA6Gfm608DsvqJXD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jesse

Path C:\Users\Admin\AppData\Local\Temp\10511\Jesse
Size 149KB
SHA256 8851a5f867f44fb70df7deac655bd2f99c89dea36e3c2db629d443b8522ed2ca
MD5 8c51756f2cd3344fa91e4d09533cdfe3
SHA1 2fd8b7a49670be2b98ebc40b6cb7f7c3b72fc92f
SHA512 7705df8876942f592c801031760488898df19c9e9447719b51a9adb34caeff8530f35709caef1639616a56b523bc1263e9040f26871f3b42bc144bd37d4594bb
SSDEEP 3072:MxF5jtHk5B+LNBPcAvPTjFq9iOIXyTw0ltj0EowPOGU6WS2uLhxjRYH/fA9vtqm/:MxNAB+xHFq9O0lHPOGUWLhxjRYmFqZvq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lid

Path C:\Users\Admin\AppData\Local\Temp\10511\Lid
Size 12KB
SHA256 691bdfeff870586f3d0efc67a50765bd656dd1a88e5e22f5265d3b0bd7e3e98a
MD5 9ad68a17f69257120a83b094a73c8315
SHA1 fea2fdfd0910556d164a6c15ca0afd8669c58048
SHA512 180c0f8b8a74b06d8b2d605b8c369b5c5b60590e972c20b536733a463745118937860ab282f89b2d4811066cc44a0187cf3325c1a7ca2de3632633076f586dad
SSDEEP 192:F3oAso+GeAS9lXK8iGIMX3B7cS1z3FqC+tygjl/4u:F3s6sXK82shcSmT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lived

Path C:\Users\Admin\AppData\Local\Temp\10511\Lived
Size 104KB
SHA256 23ea9cbfec20db0b125456f335e54eb77d9a312c5854865b81ff8283fe3a6d06
MD5 dea7d1897934cd7d4095ae842b0f0725
SHA1 2516a8c98175e335ed2550c1b0eae36f690cd7ce
SHA512 47bc8418446cf5c67b7da4718fb07312fa08d3c29d77258e0f2225d2f04498c1b89f4ca9110c0acdb0ac76900d9e94d1d83dbfdc65eb468becf2ddec703336d9
SSDEEP 3072:Bd1UhlqRWO/9EAehuqCkrwzW3Nzl8F5hPLZ:Bd12lqlEAehuqN8zwNzlmhPLZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Luck

Path C:\Users\Admin\AppData\Local\Temp\10511\Luck
Size 152KB
SHA256 9e70fdeabbebe8f69be5cb11bef2cc71807d6208279c0d9c37ac8c52a6df4502
MD5 011d8fc3405a11d2b2de2930bf3ffc4b
SHA1 2bb1882806363c027db3341fbf2b0abb7f746d35
SHA512 fe006bac8fca2d5a541f93234cd7fbe13d51cded29f4e16a8c7791d3a49015a46b11c8c7e570949729a059a705255016fc32bba9c6612ff461edd344b065e6ff
SSDEEP 1536:nvtKs51VqaHwsWcfcd0vtmgMbFuz08QuklMBNIi9u5aAwubPdw:L3q5eAg0Fuz08XvBNbIaAtbPi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path

Path C:\Users\Admin\AppData\Local\Temp\10511\Path
Size 119KB
SHA256 d4634845e59868f0b5805ab4f2d62eb54c4da94d957c173a7c55f86c1ec02e07
MD5 b4b2e18e6477cfdd68e3f7e32486ff90
SHA1 a7bf76431276284a0a0cd5cccb3094cce30213f1
SHA512 e6b66e9abbf23c6598b4780bbe52fa792235b337a235f9f3ea0e934c406d35bc36194b52cca3e5a322f9adc82898da92217be96ec734b8f9f7ebe38159ec4188
SSDEEP 1536:faj6iTcohiPfKj+wsxjgarB3RZg3EYrDWyu0uZo2+9BkxXible+:66jKj+wsxjgarB3RZgDWy4ZNogXy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Providing

Path C:\Users\Admin\AppData\Local\Temp\10511\Providing
Size 543KB
SHA256 8b93f6be19639dd7df3d65edef24e9d9d072594c42a2271ab9eda7a795cf8e86
MD5 1be5c511c898fac18bedaf2d69e238ca
SHA1 3bcde63acce95438ad883db990ad0eb9901bf643
SHA512 b281e4d2c877d5d4744296b4b7fe384a51efab72f3cebc293e32495d9cb4462773594d2ffe784b18ef2b64bde662e7602a6b38e7c863bac6a0dc20483a2c7549
SSDEEP 6144:0DVxpRZXIfIrIfeGcouaLua0WubIffIfM3vIfqNMOyc0l2Hc5IfAIfd5IfsKZ5HS:0DVZ/4m3KI6CT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\10511\Ul
Size 23KB
SHA256 1f4e747dc803c78914bbeef01bbacad828be807d86dcfb714618acaa9bf5b54e
MD5 89bb7e8d20cc60f8f199fb5be62fe74f
SHA1 da016adf17199332b046d62647bdf63d1839f183
SHA512 e65f56e55193296b5a8478a9a23ba4865eeb1db1fdac4627dea9f71b97c0b16eba4debdbfdf676bf550018873ac9fe2764f5546d18172fe2582c06e3c5fb6795
SSDEEP 384:ClgavhytCjWoQL9dR0Xvwp52UW1l/hw50gFQTVaeCV1VEVFJ8ZcGwGBk7/UMQ3K6:ClgaJyc3rE2UWb/hMjFQTVat3VEV3GPP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2812-26-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/2812-27-0x00000000023F0000-0x00000000023F1000-memory.dmp

Download

memory/2812-28-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/2812-0-0x00000000023F0000-0x00000000023F1000-memory.dmp

Download

memory/3360-29-0x00000000014B0000-0x00000000014B1000-memory.dmp

Download

memory/4628-31-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4628-32-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4628-34-0x0000000000400000-0x000000000041B000-memory.dmp

Download