raccoon | e861a034e8de4c72d7087a5d86848bf2b7ce0285e51a3f443746f493aaf68308

Analysis

max time kernel
156s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 13:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3886975ff903f64ce62670a98c31638.exe
Size

1.4MB
MD5

c3886975ff903f64ce62670a98c31638
SHA1

fdd6669b1de212e0641dbacdc370be05f93a1b6c
SHA256

e861a034e8de4c72d7087a5d86848bf2b7ce0285e51a3f443746f493aaf68308
SHA512

12fa1340042cd29b2aa558d79f157c80ba657bcf7e50642c206f314fea7dee216046ceee941327c39fc29f53e0ca8c94143ef048865e07b6021e100a9b15c7a5
SSDEEP

24576:9CPxN3/bIWVmfw+iKZNVLJhXT+fQl+JnkV6qjnPMqbAA:Qn3/bfVmfw+iAJcfQl+mP/

Score

10^/10

raccoon 6c8529645e657d45f7bbccc3dda99beb45edd413 stealer

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

6c8529645e657d45f7bbccc3dda99beb45edd413

Attributes

url4cnc
https://telete.in/too0l12y

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 5 IoCs

resource	yara_rule
behavioral2/memory/1752-12-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/1752-13-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/1752-14-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/1752-16-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/1752-18-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1272 set thread context of 1752	1272	c3886975ff903f64ce62670a98c31638.exe	110

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1272	c3886975ff903f64ce62670a98c31638.exe
1272	c3886975ff903f64ce62670a98c31638.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1272	c3886975ff903f64ce62670a98c31638.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 4016	1272	c3886975ff903f64ce62670a98c31638.exe	109
PID 1272 wrote to memory of 4016	1272	c3886975ff903f64ce62670a98c31638.exe	109
PID 1272 wrote to memory of 4016	1272	c3886975ff903f64ce62670a98c31638.exe	109
PID 1272 wrote to memory of 1752	1272	c3886975ff903f64ce62670a98c31638.exe	110
PID 1272 wrote to memory of 1752	1272	c3886975ff903f64ce62670a98c31638.exe	110
PID 1272 wrote to memory of 1752	1272	c3886975ff903f64ce62670a98c31638.exe	110
PID 1272 wrote to memory of 1752	1272	c3886975ff903f64ce62670a98c31638.exe	110
PID 1272 wrote to memory of 1752	1272	c3886975ff903f64ce62670a98c31638.exe	110
PID 1272 wrote to memory of 1752	1272	c3886975ff903f64ce62670a98c31638.exe	110
PID 1272 wrote to memory of 1752	1272	c3886975ff903f64ce62670a98c31638.exe	110
PID 1272 wrote to memory of 1752	1272	c3886975ff903f64ce62670a98c31638.exe	110
PID 1272 wrote to memory of 1752	1272	c3886975ff903f64ce62670a98c31638.exe	110

C:\Users\Admin\AppData\Local\Temp\c3886975ff903f64ce62670a98c31638.exe
"C:\Users\Admin\AppData\Local\Temp\c3886975ff903f64ce62670a98c31638.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Users\Admin\AppData\Local\Temp\c3886975ff903f64ce62670a98c31638.exe
  "C:\Users\Admin\AppData\Local\Temp\c3886975ff903f64ce62670a98c31638.exe"
  2⤵
  PID:4016
- C:\Users\Admin\AppData\Local\Temp\c3886975ff903f64ce62670a98c31638.exe
  "C:\Users\Admin\AppData\Local\Temp\c3886975ff903f64ce62670a98c31638.exe"
  2⤵
  PID:1752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-8-0x0000000074CE0000-0x0000000075490000-memory.dmp

Filesize
7.7MB

Download
memory/1272-10-0x0000000000AE0000-0x0000000000BD0000-memory.dmp

Filesize
960KB

Download
memory/1272-2-0x0000000005330000-0x00000000058D4000-memory.dmp

Filesize
5.6MB

Download
memory/1272-3-0x0000000004E20000-0x0000000004EB2000-memory.dmp

Filesize
584KB

Download
memory/1272-4-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/1272-5-0x0000000004DC0000-0x0000000004DCA000-memory.dmp

Filesize
40KB

Download
memory/1272-6-0x0000000004F10000-0x0000000004F26000-memory.dmp

Filesize
88KB

Download
memory/1272-7-0x0000000006910000-0x00000000069AC000-memory.dmp

Filesize
624KB

Download
memory/1272-1-0x0000000074CE0000-0x0000000075490000-memory.dmp

Filesize
7.7MB

Download
memory/1272-0-0x0000000000250000-0x00000000003BC000-memory.dmp

Filesize
1.4MB

Download
memory/1272-9-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/1272-11-0x0000000006220000-0x00000000062B8000-memory.dmp

Filesize
608KB

Download
memory/1272-17-0x0000000074CE0000-0x0000000075490000-memory.dmp

Filesize
7.7MB

Download
memory/1752-13-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/1752-14-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/1752-16-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/1752-12-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/1752-18-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download