raccoon | 45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503

Analysis

max time kernel
152s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 02:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe
Size 2.6MB
Sample240213-c9kleacd2s
SHA256 45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503
MD5 38439fdf4744c8a97c0dafce36e4f432
SHA1 e6f56833ecfb2b47f4e39a290bad959776fea2f1
SHA512 69feeaeb83ee5b6773e2919716d9ab2f4acee2f6115ef1731557258f42a5b529760402a091c64be1707a13c4b4cfb09e79ddb0eff24cd3e77fa1e4b355cda407
SSDEEP 49152:01+6+AFUaW+Vvdj8Lf8JtKHibnPIb2qohbLLkYPTRAEOOaS4d5eTovYuLL:XANzVvdw4Jr76oNLpPNAEkeTYpLL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

raccoon 2637bf45ccfc8a2d57025feab0be0b31 stealer

Malware Config

Extracted

Family

raccoon

Botnet

2637bf45ccfc8a2d57025feab0be0b31

http://194.116.173.154:80

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 3 IoCs

resource	yara_rule
behavioral2/memory/432-19-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/432-23-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/432-24-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs

resource	yara_rule
behavioral2/memory/432-19-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/432-23-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/432-24-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral2/memory/812-0-0x0000000000190000-0x0000000000434000-memory.dmp	INDICATOR_EXE_Packed_Fody

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 812 set thread context of 432	812	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	88

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
812	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe
812	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	812	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 1044	812	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	84
PID 812 wrote to memory of 1044	812	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	84
PID 1044 wrote to memory of 2160	1044	csc.exe	86
PID 1044 wrote to memory of 2160	1044	csc.exe	86
PID 812 wrote to memory of 3080	812	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	87
PID 812 wrote to memory of 3080	812	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	87
PID 812 wrote to memory of 3080	812	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	87
PID 812 wrote to memory of 432	812	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	88
PID 812 wrote to memory of 432	812	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	88
PID 812 wrote to memory of 432	812	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	88
PID 812 wrote to memory of 432	812	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	88
PID 812 wrote to memory of 432	812	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	88
PID 812 wrote to memory of 432	812	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	88
PID 812 wrote to memory of 432	812	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	88
PID 812 wrote to memory of 432	812	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	88

C:\Users\Admin\AppData\Local\Temp\45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe
"C:\Users\Admin\AppData\Local\Temp\45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gclb5foi\gclb5foi.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES584C.tmp" "c:\Users\Admin\AppData\Local\Temp\gclb5foi\CSCC1D1E8DB91474999816DB7AF4AFFB7.TMP"
    3⤵
    PID:2160
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:3080
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

RES584C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES584C.tmp
Size 1KB
SHA256 849a69d80b77e2e449296492e768d98d0226d97710a41532edd1f480cc8033b0
MD5 9e5cf9c059d2d10841bcb02aeee97110
SHA1 2d4aab3928ffe10da106581244b1d8c4c9fd6cf4
SHA512 dd59c4ad65a586f1f63a710ecb692b3a1b8e0e5c7da8ed3df57f7444d7967db5e3f543d9972d2c39bd7b095edc17120edfa2a86355757a78dd2c7de1b57f3241
MD5 SHA1 SHA512

Submit Download

gclb5foi.dll

Path C:\Users\Admin\AppData\Local\Temp\gclb5foi\gclb5foi.dll
Size 9KB
SHA256 481dbc895acf14d46a11b6263b3f5c51ba04d710683c0db4bba15397368fe7d6
MD5 a8793e4049484c8ab0443c0c7de9ee46
SHA1 e09c93eec14377b17f2b6f4f734d786834d2e1a8
SHA512 2ffe790e7b3f2780f507509eefb36edfb220f658b2627f90344e9358fc84ee78faedebe63a4e95f806b66972e1a86b0d4babfbc64e257e747ac3c362809e8d36
SSDEEP 192:thMFRixofmpJ1FAlEwM/rTPwrTPwrTPwrTP0PfBK7LjLaMk5MqaeT4:tqDCOKrErErEr57LjLa5Mqlk
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSCC1D1E8DB91474999816DB7AF4AFFB7.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\gclb5foi\CSCC1D1E8DB91474999816DB7AF4AFFB7.TMP
Size 652B
SHA256 e08c69f845737cfd7c4953b907d00919b9fd44775084ee27a8f8ef5dee6f31c1
MD5 44e6f9ed7fd89878374af7f8f3d49e0e
SHA1 1f8956f3bafea3f57186c8a3b3feeef4394c1dac
SHA512 38eee2f4c54c9ac3a179ac220469d70d5db49a062e093746133eed98b045d2a0fb178ebff487ae9c24d0c248a73652d84a7b4996f278aaacb66d384e1e55de80
MD5 SHA1 SHA512

Submit Download

gclb5foi.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\gclb5foi\gclb5foi.0.cs
Size 10KB
SHA256 463913a4eb1a1ec5b16cc0307e8e3910389e8505a224c695267eeed1c8d5b970
MD5 42cdf76cfeebaa4420881fdb1f349522
SHA1 ef4d59c2b791a84ef78b60dba7ab1aec1b28be1d
SHA512 ed44f969cf64ef7c68df80d09f7c8f96c6e688649995c3e624dcd1638a456a8ef66cc535b40aab43a5679fc676dc62a2160cc49a5d8bc22c7df525bfc5520a7c
SSDEEP 192:qyu5Put/CpQATZ+eqfhyhsch3h1A/Jhxo36t5Hrz4m4:S+/CpQRgsaR1euk5La
MD5 SHA1 SHA512 SSDEEP

Submit Download

gclb5foi.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\gclb5foi\gclb5foi.cmdline
Size 204B
SHA256 64aea587a330fffcf05aaac7d1213c5fe576de145b524a9425326c29cc1d1a1a
MD5 57343cc31add7959cf14f97b35e873dc
SHA1 37589dfe87a3c0a287fb7726d2285447db059caf
SHA512 eb8470b24c0c090c1e6771ff697c3ce11aeecc479ae735ad3020b11217f7226b12065f16c4694b5d9eda61e264618cde77e303d0a3de990dfe26de82a8ce9469
MD5 SHA1 SHA512

Submit Download

memory/432-19-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/432-23-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/432-24-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/812-4-0x000000001B340000-0x000000001B3C4000-memory.dmp

Download

memory/812-0-0x0000000000190000-0x0000000000434000-memory.dmp

Download

memory/812-3-0x0000000002540000-0x000000000259E000-memory.dmp

Download

memory/812-2-0x000000001B130000-0x000000001B140000-memory.dmp

Download

memory/812-1-0x00007FFC46E40000-0x00007FFC47901000-memory.dmp

Download

memory/812-17-0x0000000002620000-0x0000000002628000-memory.dmp

Download

memory/812-21-0x00007FFC46E40000-0x00007FFC47901000-memory.dmp

Download