raccoon | 305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
21-11-2023 04:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe
Size

1001KB
MD5

2f9b3ebf19b5ad8781df519868710318
SHA1

7501b719d04879b4adf918d07a621c6497494193
SHA256

305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890
SHA512

2b338fc86ed6ad97c09227d27f9be3c013896d77ff93e61126bf6ad19ffe9cffb44cc26ca5f6290d8bfdf7c3850dfa8dd9f9f47d3dee2c4ff6b3e83d90da168c
SSDEEP

12288:sYv+YQwNb+zZtoDwjT8ACMJHmfrumiNLZZZlYY+0ASM4tuSL24RBVaA:h1Nb+z/oDwjTXHASfNLZZZlYY+wM4xeA

Score

10^/10

raccoon stealer

Malware Config

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2008-3-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon
behavioral1/memory/2008-5-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon
behavioral1/memory/2008-7-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon
behavioral1/memory/2008-9-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon

Suspicious use of SetThreadContext 1 IoCs

Processes:

305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe

description	pid	process	target process
PID 2944 set thread context of 2008	2944	305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe	AppLaunch.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2988 2008 WerFault.exe AppLaunch.exe

pid	pid_target	process	target process
2988	2008	WerFault.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exeAppLaunch.exe

description	pid	process	target process
PID 2944 wrote to memory of 2008	2944	305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe	AppLaunch.exe
PID 2944 wrote to memory of 2008	2944	305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe	AppLaunch.exe
PID 2944 wrote to memory of 2008	2944	305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe	AppLaunch.exe
PID 2944 wrote to memory of 2008	2944	305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe	AppLaunch.exe
PID 2944 wrote to memory of 2008	2944	305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe	AppLaunch.exe
PID 2944 wrote to memory of 2008	2944	305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe	AppLaunch.exe
PID 2944 wrote to memory of 2008	2944	305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe	AppLaunch.exe
PID 2944 wrote to memory of 2008	2944	305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe	AppLaunch.exe
PID 2944 wrote to memory of 2008	2944	305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe	AppLaunch.exe
PID 2944 wrote to memory of 2008	2944	305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe	AppLaunch.exe
PID 2944 wrote to memory of 2008	2944	305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe	AppLaunch.exe
PID 2944 wrote to memory of 2008	2944	305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe	AppLaunch.exe
PID 2008 wrote to memory of 2988	2008	AppLaunch.exe	WerFault.exe
PID 2008 wrote to memory of 2988	2008	AppLaunch.exe	WerFault.exe
PID 2008 wrote to memory of 2988	2008	AppLaunch.exe	WerFault.exe
PID 2008 wrote to memory of 2988	2008	AppLaunch.exe	WerFault.exe
PID 2008 wrote to memory of 2988	2008	AppLaunch.exe	WerFault.exe
PID 2008 wrote to memory of 2988	2008	AppLaunch.exe	WerFault.exe
PID 2008 wrote to memory of 2988	2008	AppLaunch.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe
"C:\Users\Admin\AppData\Local\Temp\305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2944

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 196
3⤵
- Program crash
PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-1-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2008-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2008-2-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2008-3-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2008-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2008-5-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2008-7-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2008-9-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download