raccoon | 2852aa37777c3389fe94b8673cbcd6ea03a63477319ac6eacab11ecee99c8e86

Analysis

max time kernel
93s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe
Size 2.6MB
Sample240214-bt9d6adf5v
SHA256 45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503
MD5 38439fdf4744c8a97c0dafce36e4f432
SHA1 e6f56833ecfb2b47f4e39a290bad959776fea2f1
SHA512 69feeaeb83ee5b6773e2919716d9ab2f4acee2f6115ef1731557258f42a5b529760402a091c64be1707a13c4b4cfb09e79ddb0eff24cd3e77fa1e4b355cda407
SSDEEP 49152:01+6+AFUaW+Vvdj8Lf8JtKHibnPIb2qohbLLkYPTRAEOOaS4d5eTovYuLL:XANzVvdw4Jr76oNLpPNAEkeTYpLL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

raccoon 2637bf45ccfc8a2d57025feab0be0b31 stealer

Malware Config

Extracted

Family

raccoon

Botnet

2637bf45ccfc8a2d57025feab0be0b31

http://194.116.173.154:80

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 3 IoCs

resource	yara_rule
behavioral2/memory/4800-19-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/4800-23-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/4800-24-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4180 set thread context of 4800	4180	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	88

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 2200	4180	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	85
PID 4180 wrote to memory of 2200	4180	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	85
PID 2200 wrote to memory of 2864	2200	csc.exe	87
PID 2200 wrote to memory of 2864	2200	csc.exe	87
PID 4180 wrote to memory of 4800	4180	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	88
PID 4180 wrote to memory of 4800	4180	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	88
PID 4180 wrote to memory of 4800	4180	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	88
PID 4180 wrote to memory of 4800	4180	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	88
PID 4180 wrote to memory of 4800	4180	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	88
PID 4180 wrote to memory of 4800	4180	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	88
PID 4180 wrote to memory of 4800	4180	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	88
PID 4180 wrote to memory of 4800	4180	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	88

C:\Users\Admin\AppData\Local\Temp\45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe
"C:\Users\Admin\AppData\Local\Temp\45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\p0wjtoaz\p0wjtoaz.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5B01.tmp" "c:\Users\Admin\AppData\Local\Temp\p0wjtoaz\CSCA3E68ADF2BF84D4D9A71B15EFF38F86.TMP"
    3⤵
    PID:2864
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

RES5B01.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5B01.tmp
Size 1KB
SHA256 2e6be573971a488a0762c8a526fbc8d7961877351930b31696c666db62325124
MD5 8f2a8de0332c15d3e0d26ef6c22ead07
SHA1 4c27587dee1d6791778d89aa2c48d79f28ee1912
SHA512 151770d7a6a7f86a665f3a9a5a553741d05b5100a5fc6458a2ecfe932f51b6b53d63bae0b4fa66c1e6d64e48e2ffae8d78df79dd08023092721c260ac55c1056
MD5 SHA1 SHA512

Submit Download

p0wjtoaz.dll

Path C:\Users\Admin\AppData\Local\Temp\p0wjtoaz\p0wjtoaz.dll
Size 9KB
SHA256 9c176b21fa402790bcd3ffed88eb23acfe3a7efe939154d7fa94f6e3c2b135a6
MD5 044dc75b3d903c2960877a61969829ee
SHA1 a731868e63935195f92fcc5f831ea4991652a0af
SHA512 a258bccae80474333f1d28483e8b72c0fde8b8ffb65f9e4490550a15e6eeff5bcc8a53a5ced00ee1ca08224499fd07495e6e6040faea83b9789beeed326c211b
SSDEEP 192:xhMFRixofmpJ1FAlEwM/rTPwrTPwrTPwrTP0PfU7LjLask5MqIeTW:xqDCOKrErErErl7LjLK5MqjC
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSCA3E68ADF2BF84D4D9A71B15EFF38F86.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\p0wjtoaz\CSCA3E68ADF2BF84D4D9A71B15EFF38F86.TMP
Size 652B
SHA256 06643da88270b8c5ad4012c96d3e56ef62ec43aca0b4346dcc9df346444c4a0e
MD5 da63ca756c7aed27bbf168fd2cfc96b7
SHA1 8e1a98064f32ae3042ab88f64501af177dd802ca
SHA512 5c9d6893a2ca4ff799536fafad86eacb72caa39f49a0dfc0971b59eb784bd095d628a517679a733867d63a1f951d466f9b6231aef09be35bf2afeebd0ae118fd
MD5 SHA1 SHA512

Submit Download

p0wjtoaz.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\p0wjtoaz\p0wjtoaz.0.cs
Size 10KB
SHA256 463913a4eb1a1ec5b16cc0307e8e3910389e8505a224c695267eeed1c8d5b970
MD5 42cdf76cfeebaa4420881fdb1f349522
SHA1 ef4d59c2b791a84ef78b60dba7ab1aec1b28be1d
SHA512 ed44f969cf64ef7c68df80d09f7c8f96c6e688649995c3e624dcd1638a456a8ef66cc535b40aab43a5679fc676dc62a2160cc49a5d8bc22c7df525bfc5520a7c
SSDEEP 192:qyu5Put/CpQATZ+eqfhyhsch3h1A/Jhxo36t5Hrz4m4:S+/CpQRgsaR1euk5La
MD5 SHA1 SHA512 SSDEEP

Submit Download

p0wjtoaz.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\p0wjtoaz\p0wjtoaz.cmdline
Size 204B
SHA256 037286a47489f3f7f478ca99060f8ee880e1f3b072579115d7b7ca21f968ee6f
MD5 925f7b18b00f42f51d14eb2de8ac2e14
SHA1 3098491ff9f3938dcf7a355142d76e769486d8c0
SHA512 13681e1e76eedf53d20c05d0bb0f738829af9ad808442d3958f1a9d39ec034c33c3aa6735cdd27e7d9523852ca97b1bf5e87bf799f67a8a1c522024a85346f94
MD5 SHA1 SHA512

Submit Download

memory/4180-4-0x000000001B6E0000-0x000000001B764000-memory.dmp

Download

memory/4180-0-0x0000000000770000-0x0000000000A14000-memory.dmp

Download

memory/4180-3-0x000000001B760000-0x000000001B770000-memory.dmp

Download

memory/4180-2-0x00007FFB6ADC0000-0x00007FFB6B881000-memory.dmp

Download

memory/4180-1-0x0000000002B70000-0x0000000002BCE000-memory.dmp

Download

memory/4180-17-0x000000001B970000-0x000000001B978000-memory.dmp

Download

memory/4180-22-0x00007FFB6ADC0000-0x00007FFB6B881000-memory.dmp

Download

memory/4800-19-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4800-23-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4800-24-0x0000000000400000-0x0000000000416000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads