raccoon | 45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe
Size 2.6MB
Sample240213-dad51sce3w
SHA256 45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503
MD5 38439fdf4744c8a97c0dafce36e4f432
SHA1 e6f56833ecfb2b47f4e39a290bad959776fea2f1
SHA512 69feeaeb83ee5b6773e2919716d9ab2f4acee2f6115ef1731557258f42a5b529760402a091c64be1707a13c4b4cfb09e79ddb0eff24cd3e77fa1e4b355cda407
SSDEEP 49152:01+6+AFUaW+Vvdj8Lf8JtKHibnPIb2qohbLLkYPTRAEOOaS4d5eTovYuLL:XANzVvdw4Jr76oNLpPNAEkeTYpLL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

raccoon 2637bf45ccfc8a2d57025feab0be0b31 stealer

Malware Config

Extracted

Family

raccoon

Botnet

2637bf45ccfc8a2d57025feab0be0b31

http://194.116.173.154:80

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 3 IoCs

resource	yara_rule
behavioral2/memory/1208-19-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/1208-22-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/1208-24-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs

resource	yara_rule
behavioral2/memory/1208-19-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1208-22-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1208-24-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral2/memory/4792-0-0x00000000002C0000-0x0000000000564000-memory.dmp	INDICATOR_EXE_Packed_Fody

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4792 set thread context of 1208	4792	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	86

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 4216	4792	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	83
PID 4792 wrote to memory of 4216	4792	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	83
PID 4216 wrote to memory of 3480	4216	csc.exe	85
PID 4216 wrote to memory of 3480	4216	csc.exe	85
PID 4792 wrote to memory of 1208	4792	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	86
PID 4792 wrote to memory of 1208	4792	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	86
PID 4792 wrote to memory of 1208	4792	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	86
PID 4792 wrote to memory of 1208	4792	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	86
PID 4792 wrote to memory of 1208	4792	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	86
PID 4792 wrote to memory of 1208	4792	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	86
PID 4792 wrote to memory of 1208	4792	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	86
PID 4792 wrote to memory of 1208	4792	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	86

C:\Users\Admin\AppData\Local\Temp\45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe
"C:\Users\Admin\AppData\Local\Temp\45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dxo40jgx\dxo40jgx.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9E92.tmp" "c:\Users\Admin\AppData\Local\Temp\dxo40jgx\CSC827AD4E289194F569F2C23871A044C3.TMP"
    3⤵
    PID:3480
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

RES9E92.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9E92.tmp
Size 1KB
SHA256 0a0a5f37cdecbb03c6a3aaf0b99eccd00aa526a30d0d8298e76cce47e31b60b5
MD5 dcff897c36e1b1b320f3f932f3c8101c
SHA1 abfc35b7c99f201d45067a2a23961abf809ff6ea
SHA512 c5d2a95999285c446beaca8bb8859df78cf83790c24e0675609f85fa58159db613a3853aeadc685c466dc8c9d6ddc60205a49b54d4fefab886f8a03681f69418
MD5 SHA1 SHA512

Submit Download

dxo40jgx.dll

Path C:\Users\Admin\AppData\Local\Temp\dxo40jgx\dxo40jgx.dll
Size 9KB
SHA256 f9bf89984a8d6786e67f66c32abd2305daed412dd5f615901b7c55807be71e23
MD5 cdad3ee591ada7d2f0dcea3bbc034a92
SHA1 44c82d1935e7bab07cb23f85216e601aedb6746c
SHA512 1de41291591d61c1dbad047e29bf12bbfe913794e1549d75d23dbd46242a5701fdcf76bde87fbb789a4485c67b7d08aced07c6256045a453e6493eaaf83ff428
SSDEEP 192:EhMFRixofmpJ1FAlEwM/rTPwrTPwrTPwrTP0PfV7LjLaXk5Mq2eT3:EqDCOKrErErErw7LjLD5MqZL
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSC827AD4E289194F569F2C23871A044C3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\dxo40jgx\CSC827AD4E289194F569F2C23871A044C3.TMP
Size 652B
SHA256 b18bd022490bfc2fc503d35e4b070db172ad8306c67ed74caec24f8ab1cd9bc0
MD5 a9f1992a1af43afd447d49ad40e0cbb2
SHA1 39f3b2499a8675155d3d18da06e34852f7e800e2
SHA512 01a9ef698c01d059992757a4ebff3c5fcbcb664b9b881d1382433d34c83b151964e830500bd4b41ee2393c6939a900a8163a2134be060ff32d7d7cebb5c60235
MD5 SHA1 SHA512

Submit Download

dxo40jgx.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\dxo40jgx\dxo40jgx.0.cs
Size 10KB
SHA256 463913a4eb1a1ec5b16cc0307e8e3910389e8505a224c695267eeed1c8d5b970
MD5 42cdf76cfeebaa4420881fdb1f349522
SHA1 ef4d59c2b791a84ef78b60dba7ab1aec1b28be1d
SHA512 ed44f969cf64ef7c68df80d09f7c8f96c6e688649995c3e624dcd1638a456a8ef66cc535b40aab43a5679fc676dc62a2160cc49a5d8bc22c7df525bfc5520a7c
SSDEEP 192:qyu5Put/CpQATZ+eqfhyhsch3h1A/Jhxo36t5Hrz4m4:S+/CpQRgsaR1euk5La
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxo40jgx.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\dxo40jgx\dxo40jgx.cmdline
Size 204B
SHA256 8cbe9baf293f0fb30a171ff0e3f7b40fa05f889e3966d74437da4b594c6b4a55
MD5 3749cea32817723789f77386c240c7ff
SHA1 193f5ea5f384ddbda913c83f04522c3a4b965d91
SHA512 e61380ba93988ca7f9b44b0bb92bf4ec4a0b02cd7538b9acee1681570e534b9cc74abd0a8933af2e358b296a471b6f43d7ace0dc925605a3eea4876606135e30
MD5 SHA1 SHA512

Submit Download

memory/1208-19-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/1208-22-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/1208-24-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4792-4-0x000000001B120000-0x000000001B1A4000-memory.dmp

Download

memory/4792-0-0x00000000002C0000-0x0000000000564000-memory.dmp

Download

memory/4792-2-0x00000000025C0000-0x000000000261E000-memory.dmp

Download

memory/4792-3-0x0000000002620000-0x0000000002630000-memory.dmp

Download

memory/4792-1-0x00007FF8D22C0000-0x00007FF8D2D81000-memory.dmp

Download

memory/4792-17-0x0000000002830000-0x0000000002838000-memory.dmp

Download

memory/4792-23-0x00007FF8D22C0000-0x00007FF8D2D81000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads