raccoon | 4507bfc9e523a0d650c1db2ab088af56de093bde9af54687deeaebe4a3e014c1

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 11:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cdf1d36e5d566314e0f5f09b5bd32845.exe
Size

487KB
MD5

cdf1d36e5d566314e0f5f09b5bd32845
SHA1

cc31a7ff37220a8e715450cb8a857be907c44d0d
SHA256

4507bfc9e523a0d650c1db2ab088af56de093bde9af54687deeaebe4a3e014c1
SHA512

8c3a7de502efed9372396be6386d4166a396411a3748094d42c67c3c55c2d61308ad8239db7e80a23ec2b52d1bf9ee43ad2d3fe87d67a079c1298d6a847273fd
SSDEEP

12288:gDCBS+Tf513C//CVgG56h+PCQXNQCYM5muZOb:gQ33C//C+gPC9M5muZOb

Score

10^/10

raccoon b19ab3b3bd39b9aebee9d40611a5758426085c48 agilenet stealer

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

b19ab3b3bd39b9aebee9d40611a5758426085c48

Attributes

url4cnc
https://telete.in/indochipropertw

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

resource	yara_rule
behavioral2/memory/3904-7-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/3904-9-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/3904-11-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/3904-12-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/memory/2396-3-0x0000000002750000-0x000000000275C000-memory.dmp	agile_net

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2396 set thread context of 3904	2396	cdf1d36e5d566314e0f5f09b5bd32845.exe	103

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2396	cdf1d36e5d566314e0f5f09b5bd32845.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2024	2396	cdf1d36e5d566314e0f5f09b5bd32845.exe	102
PID 2396 wrote to memory of 2024	2396	cdf1d36e5d566314e0f5f09b5bd32845.exe	102
PID 2396 wrote to memory of 2024	2396	cdf1d36e5d566314e0f5f09b5bd32845.exe	102
PID 2396 wrote to memory of 3904	2396	cdf1d36e5d566314e0f5f09b5bd32845.exe	103
PID 2396 wrote to memory of 3904	2396	cdf1d36e5d566314e0f5f09b5bd32845.exe	103
PID 2396 wrote to memory of 3904	2396	cdf1d36e5d566314e0f5f09b5bd32845.exe	103
PID 2396 wrote to memory of 3904	2396	cdf1d36e5d566314e0f5f09b5bd32845.exe	103
PID 2396 wrote to memory of 3904	2396	cdf1d36e5d566314e0f5f09b5bd32845.exe	103
PID 2396 wrote to memory of 3904	2396	cdf1d36e5d566314e0f5f09b5bd32845.exe	103
PID 2396 wrote to memory of 3904	2396	cdf1d36e5d566314e0f5f09b5bd32845.exe	103
PID 2396 wrote to memory of 3904	2396	cdf1d36e5d566314e0f5f09b5bd32845.exe	103
PID 2396 wrote to memory of 3904	2396	cdf1d36e5d566314e0f5f09b5bd32845.exe	103

C:\Users\Admin\AppData\Local\Temp\cdf1d36e5d566314e0f5f09b5bd32845.exe
"C:\Users\Admin\AppData\Local\Temp\cdf1d36e5d566314e0f5f09b5bd32845.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Local\Temp\cdf1d36e5d566314e0f5f09b5bd32845.exe
  C:\Users\Admin\AppData\Local\Temp\cdf1d36e5d566314e0f5f09b5bd32845.exe
  2⤵
  PID:2024
- C:\Users\Admin\AppData\Local\Temp\cdf1d36e5d566314e0f5f09b5bd32845.exe
  C:\Users\Admin\AppData\Local\Temp\cdf1d36e5d566314e0f5f09b5bd32845.exe
  2⤵
  PID:3904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2396-0-0x0000000000330000-0x00000000003AE000-memory.dmp

Filesize
504KB

Download
memory/2396-1-0x0000000075340000-0x0000000075AF0000-memory.dmp

Filesize
7.7MB

Download
memory/2396-2-0x0000000004E20000-0x0000000004E30000-memory.dmp

Filesize
64KB

Download
memory/2396-3-0x0000000002750000-0x000000000275C000-memory.dmp

Filesize
48KB

Download
memory/2396-4-0x0000000004DA0000-0x0000000004E16000-memory.dmp

Filesize
472KB

Download
memory/2396-5-0x0000000004D80000-0x0000000004D9E000-memory.dmp

Filesize
120KB

Download
memory/2396-10-0x0000000075340000-0x0000000075AF0000-memory.dmp

Filesize
7.7MB

Download
memory/3904-7-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/3904-9-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/3904-11-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/3904-12-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download