raccoon | 7838e3b48693351eaa30bf7caf00c3b2bbe9c9595151d137cfc7c2f306af1ee2

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb286c9b98bbf94aee0c25d4ce619bc4.exe
Size

528KB
MD5

cb286c9b98bbf94aee0c25d4ce619bc4
SHA1

86fc88249d57e178df2272c857a5e090844c5161
SHA256

7838e3b48693351eaa30bf7caf00c3b2bbe9c9595151d137cfc7c2f306af1ee2
SHA512

2f9d3b6d348da9d6213dbf5007b4d12c7968036cbeab8a9e5f8b1ef285f60b727c218020715809727a343c5557ac20fd0b9ef82f6b6e65de7296e198fc34d15d
SSDEEP

12288:oshS3eRm4lUx5xhNGp6h+zuJzpgE1ikqIJp1w:osM3um4oLNOz6v1iA1w

Score

10^/10

raccoon 5193e44859ad5804816e1760796dfa9e275878b8 stealer

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

5193e44859ad5804816e1760796dfa9e275878b8

Attributes

url4cnc
https://telete.in/uipromrdarkpirat

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 5 IoCs

resource	yara_rule
behavioral2/memory/2208-5-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/2208-6-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/2208-8-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/2208-10-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/2208-12-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3944 set thread context of 2208	3944	cb286c9b98bbf94aee0c25d4ce619bc4.exe	107

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3944	cb286c9b98bbf94aee0c25d4ce619bc4.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 2208	3944	cb286c9b98bbf94aee0c25d4ce619bc4.exe	107
PID 3944 wrote to memory of 2208	3944	cb286c9b98bbf94aee0c25d4ce619bc4.exe	107
PID 3944 wrote to memory of 2208	3944	cb286c9b98bbf94aee0c25d4ce619bc4.exe	107
PID 3944 wrote to memory of 2208	3944	cb286c9b98bbf94aee0c25d4ce619bc4.exe	107
PID 3944 wrote to memory of 2208	3944	cb286c9b98bbf94aee0c25d4ce619bc4.exe	107
PID 3944 wrote to memory of 2208	3944	cb286c9b98bbf94aee0c25d4ce619bc4.exe	107
PID 3944 wrote to memory of 2208	3944	cb286c9b98bbf94aee0c25d4ce619bc4.exe	107
PID 3944 wrote to memory of 2208	3944	cb286c9b98bbf94aee0c25d4ce619bc4.exe	107
PID 3944 wrote to memory of 2208	3944	cb286c9b98bbf94aee0c25d4ce619bc4.exe	107

C:\Users\Admin\AppData\Local\Temp\cb286c9b98bbf94aee0c25d4ce619bc4.exe
"C:\Users\Admin\AppData\Local\Temp\cb286c9b98bbf94aee0c25d4ce619bc4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Users\Admin\AppData\Local\Temp\cb286c9b98bbf94aee0c25d4ce619bc4.exe
  C:\Users\Admin\AppData\Local\Temp\cb286c9b98bbf94aee0c25d4ce619bc4.exe
  2⤵
  PID:2208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3104 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:1612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2208-5-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2208-6-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2208-8-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2208-10-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2208-12-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/3944-0-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/3944-1-0x00000000009C0000-0x0000000000A4A000-memory.dmp

Filesize
552KB

Download
memory/3944-2-0x00000000053E0000-0x00000000053F0000-memory.dmp

Filesize
64KB

Download
memory/3944-3-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/3944-4-0x0000000002F00000-0x0000000002F28000-memory.dmp

Filesize
160KB

Download
memory/3944-9-0x00000000053E0000-0x00000000053F0000-memory.dmp

Filesize
64KB

Download
memory/3944-11-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download