raccoon | 45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 02:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe
Size 2.6MB
Sample240213-c1632sbb8v
SHA256 45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503
MD5 38439fdf4744c8a97c0dafce36e4f432
SHA1 e6f56833ecfb2b47f4e39a290bad959776fea2f1
SHA512 69feeaeb83ee5b6773e2919716d9ab2f4acee2f6115ef1731557258f42a5b529760402a091c64be1707a13c4b4cfb09e79ddb0eff24cd3e77fa1e4b355cda407
SSDEEP 49152:01+6+AFUaW+Vvdj8Lf8JtKHibnPIb2qohbLLkYPTRAEOOaS4d5eTovYuLL:XANzVvdw4Jr76oNLpPNAEkeTYpLL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

raccoon 2637bf45ccfc8a2d57025feab0be0b31 stealer

Malware Config

Extracted

Family

raccoon

Botnet

2637bf45ccfc8a2d57025feab0be0b31

http://194.116.173.154:80

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 3 IoCs

resource	yara_rule
behavioral2/memory/2428-23-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/2428-19-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/2428-24-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs

resource	yara_rule
behavioral2/memory/2428-23-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2428-19-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2428-24-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral2/memory/2932-0-0x0000000000C00000-0x0000000000EA4000-memory.dmp	INDICATOR_EXE_Packed_Fody

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2932 set thread context of 2428	2932	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	46

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2932	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe
2932	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2932	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 1620	2932	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	43
PID 2932 wrote to memory of 1620	2932	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	43
PID 1620 wrote to memory of 4136	1620	csc.exe	47
PID 1620 wrote to memory of 4136	1620	csc.exe	47
PID 2932 wrote to memory of 4928	2932	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	45
PID 2932 wrote to memory of 4928	2932	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	45
PID 2932 wrote to memory of 4928	2932	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	45
PID 2932 wrote to memory of 2428	2932	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	46
PID 2932 wrote to memory of 2428	2932	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	46
PID 2932 wrote to memory of 2428	2932	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	46
PID 2932 wrote to memory of 2428	2932	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	46
PID 2932 wrote to memory of 2428	2932	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	46
PID 2932 wrote to memory of 2428	2932	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	46
PID 2932 wrote to memory of 2428	2932	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	46
PID 2932 wrote to memory of 2428	2932	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	46

C:\Users\Admin\AppData\Local\Temp\45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe
"C:\Users\Admin\AppData\Local\Temp\45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mdlvmuxc\mdlvmuxc.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4362.tmp" "c:\Users\Admin\AppData\Local\Temp\mdlvmuxc\CSCD30ACCC0588E4EFCAC75BD7812BFBB0.TMP"
    3⤵
    PID:4136
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4928
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

RES4362.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4362.tmp
Size 1KB
SHA256 cf4f59f663a39f430655790b233142cdb3a37e12ad9227fcc8db1ee5c7f5ef06
MD5 e4c99a40146453865b302911bf1f8da3
SHA1 7de8fc0ae5e59a6d13ff3800ce66f463e37938f9
SHA512 0a1abb4757eefece85eaa87c8e139d037fb144ca2a2d1f2a9a8dadf8b3851ee27d31a5e3825edc1160a5cb406310bdf1ae3a4b26d9a9a3f67ec810c86823add6
MD5 SHA1 SHA512

Submit Download

mdlvmuxc.dll

Path C:\Users\Admin\AppData\Local\Temp\mdlvmuxc\mdlvmuxc.dll
Size 9KB
SHA256 568614a7e4d27a1f0b08edb9c26beaa29caa7992e661698e929c743f57804a84
MD5 7cb225fad5eb981eeb5c23129bc252aa
SHA1 c183a8e919740ea044cf2285cef3a4bdc496875c
SHA512 744ec07bf3dee151860a2bd250ceb7f0af32f6f888b86b55c0b13874c74217c5726a460b0e535ed25c382f8abce88fb533cd3165190c1f8b9d212e32d66e1350
SSDEEP 192:2hMFRixofmpJ1FAlEwM/rTPwrTPwrTPwrTP0Pfr7LjLaRk5MqueTN:2qDCOKrErErErq7LjLB5MqBh
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSCD30ACCC0588E4EFCAC75BD7812BFBB0.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\mdlvmuxc\CSCD30ACCC0588E4EFCAC75BD7812BFBB0.TMP
Size 652B
SHA256 8fa0dd7b4cfbcd3284f6b92fc17c2fd1b33d7bad85bf5daba3a474d272c21988
MD5 e0fdbfe867a77ec297ff624662377aa1
SHA1 e6d64cf796aea7662cb456206b69484fa0f03aa2
SHA512 049d674d1bec7728e68a7567a92e33c41322dd15fea349178d39473e06d4f19582ee6d4f0ce848f27eb4f04b0723ec6e2a2d4bd0addf8e3ee57abddb6f595622
MD5 SHA1 SHA512

Submit Download

mdlvmuxc.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\mdlvmuxc\mdlvmuxc.0.cs
Size 10KB
SHA256 463913a4eb1a1ec5b16cc0307e8e3910389e8505a224c695267eeed1c8d5b970
MD5 42cdf76cfeebaa4420881fdb1f349522
SHA1 ef4d59c2b791a84ef78b60dba7ab1aec1b28be1d
SHA512 ed44f969cf64ef7c68df80d09f7c8f96c6e688649995c3e624dcd1638a456a8ef66cc535b40aab43a5679fc676dc62a2160cc49a5d8bc22c7df525bfc5520a7c
SSDEEP 192:qyu5Put/CpQATZ+eqfhyhsch3h1A/Jhxo36t5Hrz4m4:S+/CpQRgsaR1euk5La
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdlvmuxc.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\mdlvmuxc\mdlvmuxc.cmdline
Size 204B
SHA256 3ab8f0dba37c8e330c15cb6cd0797a35a51df9d928d24eb5c7c9780f89aeffd9
MD5 992ee7c5a455a25c10996e7f9b858f2d
SHA1 fac05c5a19967fee2e9a89d9f29b57ad37daba7f
SHA512 d91682fb293eb03916bacf00947166c5a45375e8855bc769881d426eb11eb25a2cf4c7550d2ca316d797222e216a36d3e126e73b5df54827ac5cf09d13e229d6
MD5 SHA1 SHA512

Submit Download

memory/2428-19-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/2428-23-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/2428-24-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/2932-4-0x000000001BED0000-0x000000001BF54000-memory.dmp

Download

memory/2932-22-0x00007FFC87130000-0x00007FFC87BF1000-memory.dmp

Download

memory/2932-0-0x0000000000C00000-0x0000000000EA4000-memory.dmp

Download

memory/2932-17-0x000000001BB70000-0x000000001BB78000-memory.dmp

Download

memory/2932-2-0x00007FFC87130000-0x00007FFC87BF1000-memory.dmp

Download

memory/2932-3-0x000000001BB90000-0x000000001BBA0000-memory.dmp

Download

memory/2932-1-0x0000000002F90000-0x0000000002FEE000-memory.dmp

Download