raccoon | 5a8836d0ec8f7e56ab006e62d12403efe74a3e1962eab06329f795feb1ff11e9

General

Target

d4f8127360d5cd7e1f6a10d3dfbba6d4.exe
Size

899KB
MD5

d4f8127360d5cd7e1f6a10d3dfbba6d4
SHA1

b0abd21c3cfaaf3ccb905b88737e8c3e45de16fc
SHA256

5a8836d0ec8f7e56ab006e62d12403efe74a3e1962eab06329f795feb1ff11e9
SHA512

bda6b585b30ae58d6eaaede3d8b4eef1acdb453eaf17fb121eb8982ce5abb8abf65645122855ab5228aa2494a4c3d8344a39b1b4fc1dc466f6babec8f0db94a2
SSDEEP

24576:A4c3+VbG0AOOy8GxNCg/sHiu+uwWggp0FF8V3:Acs0lOwx/kCUp0Fi

Score

10^/10

raccoon d7b6e0cee1cd813ad40c812cf45171cf0360e249 stealer

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

d7b6e0cee1cd813ad40c812cf45171cf0360e249

Attributes

url4cnc
https://telete.in/mimipanera11

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

resource	yara_rule
behavioral1/memory/2560-4-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral1/memory/2560-6-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral1/memory/2560-8-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral1/memory/2560-9-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2332 set thread context of 2560	2332	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe	28

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2332	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2560	2332	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe	28
PID 2332 wrote to memory of 2560	2332	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe	28
PID 2332 wrote to memory of 2560	2332	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe	28
PID 2332 wrote to memory of 2560	2332	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe	28
PID 2332 wrote to memory of 2560	2332	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe	28
PID 2332 wrote to memory of 2560	2332	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe	28
PID 2332 wrote to memory of 2560	2332	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe	28
PID 2332 wrote to memory of 2560	2332	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe	28
PID 2332 wrote to memory of 2560	2332	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe	28
PID 2332 wrote to memory of 2560	2332	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe	28
PID 2332 wrote to memory of 2560	2332	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe	28
PID 2332 wrote to memory of 2560	2332	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe	28
PID 2332 wrote to memory of 2560	2332	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe	28

C:\Users\Admin\AppData\Local\Temp\d4f8127360d5cd7e1f6a10d3dfbba6d4.exe
"C:\Users\Admin\AppData\Local\Temp\d4f8127360d5cd7e1f6a10d3dfbba6d4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\AppData\Local\Temp\d4f8127360d5cd7e1f6a10d3dfbba6d4.exe
  C:\Users\Admin\AppData\Local\Temp\d4f8127360d5cd7e1f6a10d3dfbba6d4.exe
  2⤵
  - Modifies system certificate store
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2332-1-0x0000000000DE0000-0x0000000000EC2000-memory.dmp

Filesize
904KB

Download
memory/2332-0-0x00000000746A0000-0x0000000074D8E000-memory.dmp

Filesize
6.9MB

Download
memory/2332-2-0x0000000004B30000-0x0000000004B70000-memory.dmp

Filesize
256KB

Download
memory/2332-3-0x0000000000A60000-0x0000000000A86000-memory.dmp

Filesize
152KB

Download
memory/2332-7-0x00000000746A0000-0x0000000074D8E000-memory.dmp

Filesize
6.9MB

Download
memory/2560-4-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2560-6-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2560-8-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2560-9-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download

Analysis

Sharing