raccoon | 45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 02:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe
Size 2.6MB
Sample240213-c2bzascf28
SHA256 45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503
MD5 38439fdf4744c8a97c0dafce36e4f432
SHA1 e6f56833ecfb2b47f4e39a290bad959776fea2f1
SHA512 69feeaeb83ee5b6773e2919716d9ab2f4acee2f6115ef1731557258f42a5b529760402a091c64be1707a13c4b4cfb09e79ddb0eff24cd3e77fa1e4b355cda407
SSDEEP 49152:01+6+AFUaW+Vvdj8Lf8JtKHibnPIb2qohbLLkYPTRAEOOaS4d5eTovYuLL:XANzVvdw4Jr76oNLpPNAEkeTYpLL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

raccoon 2637bf45ccfc8a2d57025feab0be0b31 stealer

Malware Config

Extracted

Family

raccoon

Botnet

2637bf45ccfc8a2d57025feab0be0b31

http://194.116.173.154:80

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 3 IoCs

resource	yara_rule
behavioral2/memory/3008-19-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/3008-22-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/3008-24-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs

resource	yara_rule
behavioral2/memory/3008-19-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3008-22-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3008-24-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral2/memory/2848-0-0x0000000000E40000-0x00000000010E4000-memory.dmp	INDICATOR_EXE_Packed_Fody

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2848 set thread context of 3008	2848	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	91

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2848	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe
2848	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2848	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2660	2848	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	87
PID 2848 wrote to memory of 2660	2848	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	87
PID 2660 wrote to memory of 2680	2660	csc.exe	89
PID 2660 wrote to memory of 2680	2660	csc.exe	89
PID 2848 wrote to memory of 1320	2848	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	90
PID 2848 wrote to memory of 1320	2848	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	90
PID 2848 wrote to memory of 1320	2848	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	90
PID 2848 wrote to memory of 3008	2848	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	91
PID 2848 wrote to memory of 3008	2848	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	91
PID 2848 wrote to memory of 3008	2848	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	91
PID 2848 wrote to memory of 3008	2848	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	91
PID 2848 wrote to memory of 3008	2848	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	91
PID 2848 wrote to memory of 3008	2848	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	91
PID 2848 wrote to memory of 3008	2848	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	91
PID 2848 wrote to memory of 3008	2848	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	91

C:\Users\Admin\AppData\Local\Temp\45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe
"C:\Users\Admin\AppData\Local\Temp\45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iol1cf30\iol1cf30.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8D7B.tmp" "c:\Users\Admin\AppData\Local\Temp\iol1cf30\CSCDB1A2D7E64084BB28BCBCA1F10D5BF7A.TMP"
    3⤵
    PID:2680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1320
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:3008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

RES8D7B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8D7B.tmp
Size 1KB
SHA256 17e65943c0bda0d75f7dff4398555bfa7c07bc8064effa74deea39df298256e0
MD5 d872a60dcd82d2a3257c53d6fbb14c05
SHA1 e97d41cb26cb717af8de277b3c75fa02e1aba651
SHA512 8357be471aaf219d656c85e7b7a60d776cd9f43a23302e16ba036e281f595e08721d08880543a62e2e9b242710c64894b0553482ae2252a4947f8e8933ac45a3
MD5 SHA1 SHA512

Submit Download

iol1cf30.dll

Path C:\Users\Admin\AppData\Local\Temp\iol1cf30\iol1cf30.dll
Size 9KB
SHA256 978ffd1b4ab136ac1f2cb86ff1f7bb8f5ede202df6aa5d17d8f10b7621c1fb3d
MD5 9c5ec8e0f2cbc47f636f707887738d22
SHA1 5ab5ad387c6ffe9030c5451752e51c9b9f12ea3a
SHA512 9b89ae72df967dd09a8971d19856f47d74a739fb9f7bffe4eec1577779e10da441c78c01adfe1b2ee0f0522328ba0c92fbb925c8f7dfa9700d11fc9e5656c961
SSDEEP 192:HhMFRixofmpJ1FAlEwM/rTPwrTPwrTPwrTP0Pf67LjLaek5MqieTO:HqDCOKrErErErb7LjLo5Mqd6
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSCDB1A2D7E64084BB28BCBCA1F10D5BF7A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\iol1cf30\CSCDB1A2D7E64084BB28BCBCA1F10D5BF7A.TMP
Size 652B
SHA256 00aa57e9af1a0699c26db80ed16cbf98f64f3ca9b4f2ca5a963b11fca51e99cb
MD5 537fad25b7280af484bc9829ea6114bc
SHA1 6f45a4ebead6a84f8fd424210265f5d2bf68e90c
SHA512 e02c27c1ed4cedd3382d00028dec1d072b4aa4a92fd7943aa2a0352358d73f360f8578f49e30da5ce173946fccbdfba372a5248113142ce8ec4ff48aa5e7b79a
MD5 SHA1 SHA512

Submit Download

iol1cf30.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\iol1cf30\iol1cf30.0.cs
Size 10KB
SHA256 463913a4eb1a1ec5b16cc0307e8e3910389e8505a224c695267eeed1c8d5b970
MD5 42cdf76cfeebaa4420881fdb1f349522
SHA1 ef4d59c2b791a84ef78b60dba7ab1aec1b28be1d
SHA512 ed44f969cf64ef7c68df80d09f7c8f96c6e688649995c3e624dcd1638a456a8ef66cc535b40aab43a5679fc676dc62a2160cc49a5d8bc22c7df525bfc5520a7c
SSDEEP 192:qyu5Put/CpQATZ+eqfhyhsch3h1A/Jhxo36t5Hrz4m4:S+/CpQRgsaR1euk5La
MD5 SHA1 SHA512 SSDEEP

Submit Download

iol1cf30.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\iol1cf30\iol1cf30.cmdline
Size 204B
SHA256 3231da1303aabdf7cfeb7c072404b0473edd108a097bdb65487e9e9da23ceca3
MD5 1d205cf001650176d9568ace91762891
SHA1 b47e0114dfe0672f5683b24ee7e51f772ed2faac
SHA512 10ef5ebef4771c4c4d8a7b765068e0f80476083903aa643015d9ab946ec97d0d23f356fd3912862b421f5b83353462202a02af6ad638dab76ad4282161a55859
MD5 SHA1 SHA512

Submit Download

memory/2848-4-0x000000001BE40000-0x000000001BEC4000-memory.dmp

Download

memory/2848-0-0x0000000000E40000-0x00000000010E4000-memory.dmp

Download

memory/2848-3-0x000000001BEF0000-0x000000001BF00000-memory.dmp

Download

memory/2848-2-0x00007FFCAF740000-0x00007FFCB0201000-memory.dmp

Download

memory/2848-1-0x0000000003140000-0x000000000319E000-memory.dmp

Download

memory/2848-17-0x000000001BCA0000-0x000000001BCA8000-memory.dmp

Download

memory/2848-23-0x00007FFCAF740000-0x00007FFCB0201000-memory.dmp

Download

memory/3008-19-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/3008-22-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/3008-24-0x0000000000400000-0x0000000000416000-memory.dmp

Download