Analysis

  • max time kernel
    139s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/10/2023, 05:57

General

  • Target

    INV-PL (KF-20230920-KB) ???????????????????(?.exe

  • Size

    491KB

  • MD5

    d7efde7a4ae17a23044520ef4b1d6580

  • SHA1

    625c66ee9ea45af883ddf19d98c730d24838204e

  • SHA256

    989acc1c32f6dab02d1d29f18483f94d98b0708ddb057ce7404c348cb2b073f7

  • SHA512

    a32589592835e4ce1fe2986e8728add41a75028f7c77885f2a8ed991a9d662419f93f10449f3f0947cb88f078f9d70dbc0803ab78a896146cfbc87be2b24403c

  • SSDEEP

    12288:SZEMFB+H+5qrrQaj+o1Dz1eh0910GxAVU9DGe4:x8sSApb910Gay9R

Malware Config

Extracted

Family

raccoon

Botnet

20d8a2575ef4404ffce8393cb3e5ccc6

C2

http://85.203.26.94:80/

Attributes
  • user_agent

    SunShineMoonLight

xor.plain

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • Raccoon Stealer payload 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\INV-PL (KF-20230920-KB) ___________________(_.exe
    "C:\Users\Admin\AppData\Local\Temp\INV-PL (KF-20230920-KB) ___________________(_.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3320
    • C:\Users\Admin\AppData\Local\Temp\INV-PL (KF-20230920-KB) ___________________(_.exe
      "C:\Users\Admin\AppData\Local\Temp\INV-PL (KF-20230920-KB) ___________________(_.exe"
      2⤵
        PID:2884
      • C:\Users\Admin\AppData\Local\Temp\INV-PL (KF-20230920-KB) ___________________(_.exe
        "C:\Users\Admin\AppData\Local\Temp\INV-PL (KF-20230920-KB) ___________________(_.exe"
        2⤵
          PID:4988

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/3320-8-0x0000000074800000-0x0000000074FB0000-memory.dmp

              Filesize

              7.7MB

            • memory/3320-9-0x0000000004E10000-0x0000000004E20000-memory.dmp

              Filesize

              64KB

            • memory/3320-2-0x0000000005170000-0x0000000005714000-memory.dmp

              Filesize

              5.6MB

            • memory/3320-3-0x0000000004BC0000-0x0000000004C52000-memory.dmp

              Filesize

              584KB

            • memory/3320-4-0x0000000004E10000-0x0000000004E20000-memory.dmp

              Filesize

              64KB

            • memory/3320-5-0x0000000004D50000-0x0000000004D5A000-memory.dmp

              Filesize

              40KB

            • memory/3320-6-0x0000000004EC0000-0x0000000004F5C000-memory.dmp

              Filesize

              624KB

            • memory/3320-7-0x0000000004E70000-0x0000000004E80000-memory.dmp

              Filesize

              64KB

            • memory/3320-1-0x0000000074800000-0x0000000074FB0000-memory.dmp

              Filesize

              7.7MB

            • memory/3320-10-0x0000000004EB0000-0x0000000004EB6000-memory.dmp

              Filesize

              24KB

            • memory/3320-0-0x0000000000190000-0x0000000000210000-memory.dmp

              Filesize

              512KB

            • memory/3320-11-0x0000000005160000-0x000000000516A000-memory.dmp

              Filesize

              40KB

            • memory/3320-12-0x0000000006000000-0x0000000006058000-memory.dmp

              Filesize

              352KB

            • memory/3320-17-0x0000000074800000-0x0000000074FB0000-memory.dmp

              Filesize

              7.7MB

            • memory/4988-16-0x0000000000400000-0x000000000041B000-memory.dmp

              Filesize

              108KB

            • memory/4988-13-0x0000000000400000-0x000000000041B000-memory.dmp

              Filesize

              108KB

            • memory/4988-18-0x0000000000400000-0x000000000041B000-memory.dmp

              Filesize

              108KB