raccoon | 0dcfcccd6ae895d9e5dbf703cdfc8becb6aa20d56e756bba84c84837cf5c55f1

Analysis

max time kernel
53s
max time network
61s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
13/03/2024, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ir41_qc/topoedit.exe
Size 229KB
Sample240313-ls68hscc26
SHA256 b874e5abdd7c008d47560fda4e84db893ac63c18c3a5a450d25f4e62ed8e8d8c
MD5 88691dbfa349db78f96e3278d1afc943
SHA1 f5624018c9e9c6e9f42ebb08fcd46f1b598c47d3
SHA512 70acedd1af236d187d400b3be56a91df6397b3f2f79b64296711efe9f503f4b4151b4617a4cafdf80fcf6767990fce906b8d9b885ba09561ff662d37ddcabbaa
SSDEEP 3072:4XM/O19qfAuKEWUu8hzls0khPA+xvGEVsZVZ+1DNYlw1BRE84Yowo3BJTo:Ps9qDP3svPA+xeEV8VZ8Dmlw13opA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

raccoon a422219cb64fce84af4367b7d81c5df3 stealer

Malware Config

Extracted

Family

raccoon

Botnet

a422219cb64fce84af4367b7d81c5df3

http://91.103.252.217:80/

Attributes

user_agent
Xmlst

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 2 IoCs

resource	yara_rule
behavioral6/memory/4188-23-0x0000000000400000-0x0000000000497000-memory.dmp	family_raccoon_v2
behavioral6/memory/4188-28-0x0000000000400000-0x0000000000497000-memory.dmp	family_raccoon_v2

Loads dropped DLL 1 IoCs

pid	Process
4188	sxshared.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4856 set thread context of 1236	4856	topoedit.exe	73
PID 1236 set thread context of 4188	1236	cmd.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
596	4188	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4856	topoedit.exe
1236	cmd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4856	topoedit.exe
1236	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 1236	4856	topoedit.exe	73
PID 4856 wrote to memory of 1236	4856	topoedit.exe	73
PID 4856 wrote to memory of 1236	4856	topoedit.exe	73
PID 4856 wrote to memory of 1236	4856	topoedit.exe	73
PID 1236 wrote to memory of 4188	1236	cmd.exe	81
PID 1236 wrote to memory of 4188	1236	cmd.exe	81
PID 1236 wrote to memory of 4188	1236	cmd.exe	81
PID 1236 wrote to memory of 4188	1236	cmd.exe	81

C:\Users\Admin\AppData\Local\Temp\ir41_qc\topoedit.exe
"C:\Users\Admin\AppData\Local\Temp\ir41_qc\topoedit.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Users\Admin\AppData\Local\Temp\sxshared.exe
    C:\Users\Admin\AppData\Local\Temp\sxshared.exe
    3⤵
    - Loads dropped DLL
    PID:4188
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 7084
      4⤵
      Program crash
      PID:596

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

52bdbff1

Path C:\Users\Admin\AppData\Local\Temp\52bdbff1
Size 513KB
SHA256 fcb68657df7eebec502ca21e380ae648d9be841b81bb378e969f7272bd140a19
MD5 57af93374485c6e04c3faea2714ee61a
SHA1 51ec1f3ead3446d8daa9a38476e7e29bd0937ecb
SHA512 ac1d9168e4614557fea0c4deb595cf64dad7e8a4fd33892eaf700ca76bc246a2b332d44718c09daba649c16fbe629c99efdef007ef15c6a1e437d64e7cfad10a
SSDEEP 12288:5yvkU/aeg44LfLcx9WqMsfxQlKkh2WT8+EgBEfVdPyE:oMbecLzHx8PGEfLKE
MD5 SHA1 SHA512 SSDEEP

Submit Download

abwwigixrr

Path C:\Users\Admin\AppData\Local\Temp\abwwigixrr
Size 40B
SHA256 514fbb96130cd286e96712a03d44013f78a5f494da9982d98b3d92e5144bab8d
MD5 22c9ed25add6ba81f74e3194a42cddad
SHA1 c8f9ef8d8527a1d51220d857aed4c2178250d4a7
SHA512 d1c7299f7ffb19cc1b0d6966d4256513389f90775eaafb5b90ad89b4c6e5f1f28a8f706efd4f73d2f19299a92e9a7fe598fb8d35b31fa6ab01b7269398129ea6
MD5 SHA1 SHA512

Submit Download

sxshared.exe

Path C:\Users\Admin\AppData\Local\Temp\sxshared.exe
Size 301KB
SHA256 c50bffbef786eb689358c63fc0585792d174c5e281499f12035afa1ce2ce19c8
MD5 68cefdfbd2e1a35e8c4f144e37d77a76
SHA1 0a6637d5eb3c958a0136358d0290514c7309af73
SHA512 88d79115a6a0c487bd39a00a202f2467f4e05991da780f29f33cfc1ca53d2c6489104d5fbbe7e70167eb20c958b0322690454aec9ab1776d265ab8c558e971f6
SSDEEP 6144:SemIWncUsq/i4vo6cRwtf/STC47MSzISIJTc6TDRb8:3jccjai4vo6cRb+4QScSI7Bb8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1236-10-0x0000000072700000-0x0000000073A83000-memory.dmp

Download

memory/1236-12-0x0000000072700000-0x0000000073A83000-memory.dmp

Download

memory/1236-15-0x0000000072700000-0x0000000073A83000-memory.dmp

Download

memory/1236-6-0x00007FF8E8910000-0x00007FF8E8AEB000-memory.dmp

Download

memory/1236-21-0x0000000072700000-0x0000000073A83000-memory.dmp

Download

memory/4188-19-0x00007FF8E8910000-0x00007FF8E8AEB000-memory.dmp

Download

memory/4188-20-0x0000000072700000-0x0000000073A83000-memory.dmp

Download

memory/4188-22-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4188-23-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4188-27-0x0000000072700000-0x0000000073A83000-memory.dmp

Download

memory/4188-28-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4856-3-0x00007FF8CB0E0000-0x00007FF8CC78E000-memory.dmp

Download