raccoon | 983dfa8c2d0b3504397327fcfa783e96e39538d0a8496b9ee912c18210adbe5b

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5288023466d3fb96b19334b2518118f5.exe
Size

531KB
MD5

5288023466d3fb96b19334b2518118f5
SHA1

0411581d274e8dd02cdafe912d43b6df59f0ce0b
SHA256

983dfa8c2d0b3504397327fcfa783e96e39538d0a8496b9ee912c18210adbe5b
SHA512

c260a7dee278e2447df63575a833cd4a6e8db4eb5f81f40ce0622308f832cc75afb68d96b9e4078b878e2f2eb063aa2f35ce7760ecd15f2d61bbf9e6a2806c65
SSDEEP

12288:ah77hp/a2CBWQ3gnVZd3OOm9Fd/rL2qsdG+hB+/e:ehpZCBWQQnVZNOT9F5mG+h8/e

Score

10^/10

raccoon 92be0387873e54dd629b9bfa972c3a9a88e6726c stealer

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

92be0387873e54dd629b9bfa972c3a9a88e6726c

Attributes

url4cnc
https://t.me/gishsunsetman

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 5 IoCs

resource	yara_rule
behavioral2/memory/4052-11-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/4052-9-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/4052-8-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/4052-6-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/4052-12-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2456 set thread context of 4052	2456	5288023466d3fb96b19334b2518118f5.exe	98

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2456	5288023466d3fb96b19334b2518118f5.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 4052	2456	5288023466d3fb96b19334b2518118f5.exe	98
PID 2456 wrote to memory of 4052	2456	5288023466d3fb96b19334b2518118f5.exe	98
PID 2456 wrote to memory of 4052	2456	5288023466d3fb96b19334b2518118f5.exe	98
PID 2456 wrote to memory of 4052	2456	5288023466d3fb96b19334b2518118f5.exe	98
PID 2456 wrote to memory of 4052	2456	5288023466d3fb96b19334b2518118f5.exe	98
PID 2456 wrote to memory of 4052	2456	5288023466d3fb96b19334b2518118f5.exe	98
PID 2456 wrote to memory of 4052	2456	5288023466d3fb96b19334b2518118f5.exe	98
PID 2456 wrote to memory of 4052	2456	5288023466d3fb96b19334b2518118f5.exe	98
PID 2456 wrote to memory of 4052	2456	5288023466d3fb96b19334b2518118f5.exe	98

C:\Users\Admin\AppData\Local\Temp\5288023466d3fb96b19334b2518118f5.exe
"C:\Users\Admin\AppData\Local\Temp\5288023466d3fb96b19334b2518118f5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Users\Admin\AppData\Local\Temp\5288023466d3fb96b19334b2518118f5.exe
  C:\Users\Admin\AppData\Local\Temp\5288023466d3fb96b19334b2518118f5.exe
  2⤵
  PID:4052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2456-1-0x00000000752F0000-0x0000000075AA0000-memory.dmp

Filesize
7.7MB

Download
memory/2456-2-0x0000000002490000-0x00000000024A0000-memory.dmp

Filesize
64KB

Download
memory/2456-0-0x0000000000070000-0x00000000000F8000-memory.dmp

Filesize
544KB

Download
memory/2456-3-0x0000000002460000-0x0000000002480000-memory.dmp

Filesize
128KB

Download
memory/2456-4-0x0000000004B40000-0x0000000004BB6000-memory.dmp

Filesize
472KB

Download
memory/2456-5-0x0000000004B00000-0x0000000004B1E000-memory.dmp

Filesize
120KB

Download
memory/2456-10-0x00000000752F0000-0x0000000075AA0000-memory.dmp

Filesize
7.7MB

Download
memory/4052-11-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/4052-9-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/4052-8-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/4052-6-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/4052-12-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download