Analysis
- max time kernel
146s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
03/02/2024, 08:40
General
- Target 8be4597670980d68f8e61a9c04bf6de2.exe
- Size 905KB
- Sample240203-klcjwsdcd5
- SHA256 b6bca3be46b8233b37c3f473362d8c749d302d3183d07487ff09d267f082d02a
Malware Config
Extracted
-
raccoon
-
1.7.3
-
d7b6e0cee1cd813ad40c812cf45171cf0360e249
-
url4cnc
https://telete.in/mimipanera11
Signatures
- Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
- Raccoon Stealer V1 payload 4 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8be4597670980d68f8e61a9c04bf6de2.exe"C:\Users\Admin\AppData\Local\Temp\8be4597670980d68f8e61a9c04bf6de2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8be4597670980d68f8e61a9c04bf6de2.exeC:\Users\Admin\AppData\Local\Temp\8be4597670980d68f8e61a9c04bf6de2.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\8be4597670980d68f8e61a9c04bf6de2.exeC:\Users\Admin\AppData\Local\Temp\8be4597670980d68f8e61a9c04bf6de2.exe2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3472-0-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/3472-1-0x0000000000670000-0x0000000000754000-memory.dmp
memory/3472-2-0x00000000056D0000-0x0000000005C74000-memory.dmp
memory/3472-3-0x00000000051C0000-0x0000000005252000-memory.dmp
memory/3472-4-0x0000000005350000-0x0000000005360000-memory.dmp
memory/3472-5-0x0000000005160000-0x000000000516A000-memory.dmp
memory/3472-6-0x00000000053D0000-0x00000000053F6000-memory.dmp
memory/3472-12-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/4020-8-0x0000000000400000-0x0000000000495000-memory.dmp
memory/4020-11-0x0000000000400000-0x0000000000495000-memory.dmp
memory/4020-10-0x0000000000400000-0x0000000000495000-memory.dmp
memory/4020-7-0x0000000000400000-0x0000000000495000-memory.dmp