raccoon | 45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503

Analysis

max time kernel
128s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 02:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe
Size 2.6MB
Sample240213-cyf4vaag4v
SHA256 45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503
MD5 38439fdf4744c8a97c0dafce36e4f432
SHA1 e6f56833ecfb2b47f4e39a290bad959776fea2f1
SHA512 69feeaeb83ee5b6773e2919716d9ab2f4acee2f6115ef1731557258f42a5b529760402a091c64be1707a13c4b4cfb09e79ddb0eff24cd3e77fa1e4b355cda407
SSDEEP 49152:01+6+AFUaW+Vvdj8Lf8JtKHibnPIb2qohbLLkYPTRAEOOaS4d5eTovYuLL:XANzVvdw4Jr76oNLpPNAEkeTYpLL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

raccoon 2637bf45ccfc8a2d57025feab0be0b31 stealer

Malware Config

Extracted

Family

raccoon

Botnet

2637bf45ccfc8a2d57025feab0be0b31

http://194.116.173.154:80

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 3 IoCs

resource	yara_rule
behavioral2/memory/1236-19-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/1236-23-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/1236-24-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs

resource	yara_rule
behavioral2/memory/1236-19-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1236-23-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1236-24-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral2/memory/4652-0-0x0000000000310000-0x00000000005B4000-memory.dmp	INDICATOR_EXE_Packed_Fody

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4652 set thread context of 1236	4652	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	18

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4652	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe
4652	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4652	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 1900	4652	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	16
PID 4652 wrote to memory of 1900	4652	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	16
PID 1900 wrote to memory of 1276	1900	csc.exe	20
PID 1900 wrote to memory of 1276	1900	csc.exe	20
PID 4652 wrote to memory of 4916	4652	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	19
PID 4652 wrote to memory of 4916	4652	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	19
PID 4652 wrote to memory of 4916	4652	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	19
PID 4652 wrote to memory of 1236	4652	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	18
PID 4652 wrote to memory of 1236	4652	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	18
PID 4652 wrote to memory of 1236	4652	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	18
PID 4652 wrote to memory of 1236	4652	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	18
PID 4652 wrote to memory of 1236	4652	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	18
PID 4652 wrote to memory of 1236	4652	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	18
PID 4652 wrote to memory of 1236	4652	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	18
PID 4652 wrote to memory of 1236	4652	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	18

C:\Users\Admin\AppData\Local\Temp\45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe
"C:\Users\Admin\AppData\Local\Temp\45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3rsktgc1\3rsktgc1.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4DA3.tmp" "c:\Users\Admin\AppData\Local\Temp\3rsktgc1\CSC439BA96963DF4939AEEA4518767C89E.TMP"
    3⤵
    PID:1276
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1236
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

3rsktgc1.dll

Path C:\Users\Admin\AppData\Local\Temp\3rsktgc1\3rsktgc1.dll
Size 9KB
SHA256 b6f5a5be5ea38824891c285d140aaa70831aa390068bd36292de0ecb0204bcf3
MD5 e29a72675d458941e509d5cc3850ac6d
SHA1 0ac9bd09865cbc9a3f51e20df7206d75e8740dd2
SHA512 84cbfa837d3729ea435a399fcaf442ba3004b839685ff9fb5924872d87f0ab10a3486a7774631dc2ace7d2dee2aa4d2e5d5f7e1b39d638aca97c4d4394be027a
SSDEEP 192:HxhMFRixofmpJ1FAlEwM/rTPwrTPwrTPwrTP0Pfx7LjLa7k5Mq6eTN:RqDCOKrErErErg7LjL/5MqFh
MD5 SHA1 SHA512 SSDEEP

Submit Download

RES4DA3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4DA3.tmp
Size 1KB
SHA256 4b4d673068de9dacafe7ea8701fcc4e679c82278819a9e9e94ed4b7e50a6ab40
MD5 ec4c59476257fa6514e9018549c458e2
SHA1 2223404647198f350af06ab7fa27564e36b27457
SHA512 f2d05eff443e504575c17d64ca4de40a2bbcce04d7b42cb2bb97033bc87e9291e52d0d4606d412cc38d2c1df22848b7b593da574b5b799c250201358b98158bd
MD5 SHA1 SHA512

Submit Download

3rsktgc1.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\3rsktgc1\3rsktgc1.0.cs
Size 1KB
SHA256 6210f210adb7bc763f1f78964fb951fdf622202cd78f0191649a77fa6fd01164
MD5 f5829a84ccc8c97f4e676f27f981b1ff
SHA1 c9e319ddb507f890f5af8f775e720a2120912023
SHA512 afc00afc72433c9e48ef53b94f1879aa77139a5a0885b382d3429338ed6500f040630e3b12e381354a7249556b45f1bf7a25c047335a66a6ea6bdb920880a1b3
MD5 SHA1 SHA512

Submit Download

3rsktgc1.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\3rsktgc1\3rsktgc1.cmdline
Size 204B
SHA256 0aae1dae5d130e51e93c3809d46e466c5cbf1360b806ad128ab2115cb489383e
MD5 58b933cbee974a3f9d87a712574c44a6
SHA1 f28a99fce78b5a539f53425e7dd2b0ba7ad36519
SHA512 f5ff8e9bf9652e40a7469ca99c802c42fbff5ef09b5ea26bc9c838cabf0fe9f76aec424fd4d67dd7aaf38f7394acb65bf011749f3049b513bbc2ca36aad0271d
MD5 SHA1 SHA512

Submit Download

CSC439BA96963DF4939AEEA4518767C89E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\3rsktgc1\CSC439BA96963DF4939AEEA4518767C89E.TMP
Size 652B
SHA256 927828b9bf9c5c736fc378b7bd66d2a826135a8e44adeb44327b8114969b027a
MD5 88d1d11517dc901606ca90c423fc8d22
SHA1 1e5dcb0c4da39cf4ae65fc1a014c864da2359477
SHA512 70d57cf41dbd1539216b4a91bb8f97823426f41b6ffc03906992db8739b882ac214afa92cc571eeaf73a8ffc200417b118b890b2b1924993d04e731017b3f30c
MD5 SHA1 SHA512

Submit Download

memory/1236-23-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/1236-24-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/1236-19-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4652-2-0x00007FFFD7B70000-0x00007FFFD8631000-memory.dmp

Download

memory/4652-22-0x00007FFFD7B70000-0x00007FFFD8631000-memory.dmp

Download

memory/4652-17-0x000000001B230000-0x000000001B238000-memory.dmp

Download

memory/4652-0-0x0000000000310000-0x00000000005B4000-memory.dmp

Download

memory/4652-3-0x00000000027D0000-0x00000000027E0000-memory.dmp

Download

memory/4652-4-0x000000001B5A0000-0x000000001B624000-memory.dmp

Download

memory/4652-1-0x00000000027E0000-0x000000000283E000-memory.dmp

Download