raccoon | 45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503

Analysis

max time kernel
91s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe
Size 2.6MB
Sample240213-c6w52aca2y
SHA256 45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503
MD5 38439fdf4744c8a97c0dafce36e4f432
SHA1 e6f56833ecfb2b47f4e39a290bad959776fea2f1
SHA512 69feeaeb83ee5b6773e2919716d9ab2f4acee2f6115ef1731557258f42a5b529760402a091c64be1707a13c4b4cfb09e79ddb0eff24cd3e77fa1e4b355cda407
SSDEEP 49152:01+6+AFUaW+Vvdj8Lf8JtKHibnPIb2qohbLLkYPTRAEOOaS4d5eTovYuLL:XANzVvdw4Jr76oNLpPNAEkeTYpLL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

raccoon 2637bf45ccfc8a2d57025feab0be0b31 stealer

Malware Config

Extracted

Family

raccoon

Botnet

2637bf45ccfc8a2d57025feab0be0b31

http://194.116.173.154:80

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 3 IoCs

resource	yara_rule
behavioral2/memory/3928-19-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/3928-22-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/3928-24-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs

resource	yara_rule
behavioral2/memory/3928-19-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3928-22-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3928-24-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral2/memory/2712-0-0x0000000000100000-0x00000000003A4000-memory.dmp	INDICATOR_EXE_Packed_Fody

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2712 set thread context of 3928	2712	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	87

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 4576	2712	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	84
PID 2712 wrote to memory of 4576	2712	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	84
PID 4576 wrote to memory of 560	4576	csc.exe	86
PID 4576 wrote to memory of 560	4576	csc.exe	86
PID 2712 wrote to memory of 3928	2712	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	87
PID 2712 wrote to memory of 3928	2712	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	87
PID 2712 wrote to memory of 3928	2712	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	87
PID 2712 wrote to memory of 3928	2712	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	87
PID 2712 wrote to memory of 3928	2712	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	87
PID 2712 wrote to memory of 3928	2712	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	87
PID 2712 wrote to memory of 3928	2712	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	87
PID 2712 wrote to memory of 3928	2712	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	87

C:\Users\Admin\AppData\Local\Temp\45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe
"C:\Users\Admin\AppData\Local\Temp\45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jqzcpgia\jqzcpgia.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3E70.tmp" "c:\Users\Admin\AppData\Local\Temp\jqzcpgia\CSCA2C25703368F49A1B7B3CBB0C19BD174.TMP"
    3⤵
    PID:560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:3928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

RES3E70.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3E70.tmp
Size 1KB
SHA256 a275a218a04a2a5fa54ce9dde276f4ae77969d6c3087b39c171d809c167597d7
MD5 2f4df05e55a6fc1c567a6798f42d8a32
SHA1 8b76c15ce7581a672eaaebbf5453f06fe691f690
SHA512 c82f581fd17ce66a2cb77ab412fcdb60c071b8fe5f5ed190824d91c0c90b3e78febe19cf05c159005f537414e207d0fd300294449ee7e848a0f1efe87a054acd
MD5 SHA1 SHA512

Submit Download

jqzcpgia.dll

Path C:\Users\Admin\AppData\Local\Temp\jqzcpgia\jqzcpgia.dll
Size 9KB
SHA256 188dc2da2ba41878476e938dad17043d5fbd33269411b9e3b2a2881762452752
MD5 ec9ff77af59f0dbdfd90a7f08b782d39
SHA1 3b063604dd8356e9ab0fe996a496254dfab9c79c
SHA512 92e0ae1639ab60bed06b6ef124f30cae0ebac7616c8ac11a4bd06945ae20f469778df74717c074f01e0aabb698be3a3b75303df3165e12e18902a6f5a2e5f4cb
SSDEEP 192:QhMFRixofmpJ1FAlEwM/rTPwrTPwrTPwrTP0Pf+7LjLaak5MqUeT+:QqDCOKrErErErn7LjL85Mq3q
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSCA2C25703368F49A1B7B3CBB0C19BD174.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\jqzcpgia\CSCA2C25703368F49A1B7B3CBB0C19BD174.TMP
Size 652B
SHA256 cbcd4dedf291bf43a126e3d7231ac42d5a1a0b2cd178f0a1f075c368dd1453d7
MD5 1cbaaad90d74b9b40c089202f468824d
SHA1 b7dddfd8911fbe8ddbdf9b6d6265b8c534bac202
SHA512 a89f1ee510e54e4c3eadad780c0ec1542390e4c8cfc5cdd95af1de7b4f93180f9c17250d95d33ffbb733e71bc10d37dfc6062de54ab878ab865413faa1b4b781
MD5 SHA1 SHA512

Submit Download

jqzcpgia.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\jqzcpgia\jqzcpgia.0.cs
Size 10KB
SHA256 463913a4eb1a1ec5b16cc0307e8e3910389e8505a224c695267eeed1c8d5b970
MD5 42cdf76cfeebaa4420881fdb1f349522
SHA1 ef4d59c2b791a84ef78b60dba7ab1aec1b28be1d
SHA512 ed44f969cf64ef7c68df80d09f7c8f96c6e688649995c3e624dcd1638a456a8ef66cc535b40aab43a5679fc676dc62a2160cc49a5d8bc22c7df525bfc5520a7c
SSDEEP 192:qyu5Put/CpQATZ+eqfhyhsch3h1A/Jhxo36t5Hrz4m4:S+/CpQRgsaR1euk5La
MD5 SHA1 SHA512 SSDEEP

Submit Download

jqzcpgia.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\jqzcpgia\jqzcpgia.cmdline
Size 204B
SHA256 451d7fed04cbec10ac058d68d77b6eafa635ca6f67d79ffacac329238279883f
MD5 aa189001aee6daa9b45b36b995d7fd44
SHA1 f681c500f0db68a5972d18f64f6b94a00eaf34f4
SHA512 f3d02aa9865d09b4f70cbf5fd66ef0c81816ce3d415c51211ec2b62d0c9e583628edd75c184efaa4102c69c3afba343bf6be7d271d43ffe587bc2f970dbc116c
MD5 SHA1 SHA512

Submit Download

memory/2712-4-0x0000000002670000-0x00000000026F4000-memory.dmp

Download

memory/2712-0-0x0000000000100000-0x00000000003A4000-memory.dmp

Download

memory/2712-17-0x0000000002710000-0x0000000002718000-memory.dmp

Download

memory/2712-3-0x0000000002500000-0x0000000002510000-memory.dmp

Download

memory/2712-1-0x0000000000B50000-0x0000000000BAE000-memory.dmp

Download

memory/2712-2-0x00007FFCEBE20000-0x00007FFCEC8E1000-memory.dmp

Download

memory/2712-23-0x00007FFCEBE20000-0x00007FFCEC8E1000-memory.dmp

Download

memory/3928-19-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/3928-22-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/3928-24-0x0000000000400000-0x0000000000416000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads