raccoon | 5a8836d0ec8f7e56ab006e62d12403efe74a3e1962eab06329f795feb1ff11e9

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 02:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4f8127360d5cd7e1f6a10d3dfbba6d4.exe
Size

899KB
MD5

d4f8127360d5cd7e1f6a10d3dfbba6d4
SHA1

b0abd21c3cfaaf3ccb905b88737e8c3e45de16fc
SHA256

5a8836d0ec8f7e56ab006e62d12403efe74a3e1962eab06329f795feb1ff11e9
SHA512

bda6b585b30ae58d6eaaede3d8b4eef1acdb453eaf17fb121eb8982ce5abb8abf65645122855ab5228aa2494a4c3d8344a39b1b4fc1dc466f6babec8f0db94a2
SSDEEP

24576:A4c3+VbG0AOOy8GxNCg/sHiu+uwWggp0FF8V3:Acs0lOwx/kCUp0Fi

Score

10^/10

raccoon d7b6e0cee1cd813ad40c812cf45171cf0360e249 stealer

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

d7b6e0cee1cd813ad40c812cf45171cf0360e249

Attributes

url4cnc
https://telete.in/mimipanera11

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 1 IoCs

resource	yara_rule
behavioral2/memory/2560-7-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4460 set thread context of 2560	4460	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe	99

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1764	2560	WerFault.exe	99

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4460	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2560	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 2560	4460	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe	99
PID 4460 wrote to memory of 2560	4460	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe	99
PID 4460 wrote to memory of 2560	4460	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe	99
PID 4460 wrote to memory of 2560	4460	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe	99
PID 4460 wrote to memory of 2560	4460	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe	99
PID 4460 wrote to memory of 2560	4460	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe	99
PID 4460 wrote to memory of 2560	4460	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe	99
PID 4460 wrote to memory of 2560	4460	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe	99
PID 4460 wrote to memory of 2560	4460	d4f8127360d5cd7e1f6a10d3dfbba6d4.exe	99

C:\Users\Admin\AppData\Local\Temp\d4f8127360d5cd7e1f6a10d3dfbba6d4.exe
"C:\Users\Admin\AppData\Local\Temp\d4f8127360d5cd7e1f6a10d3dfbba6d4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Users\Admin\AppData\Local\Temp\d4f8127360d5cd7e1f6a10d3dfbba6d4.exe
  C:\Users\Admin\AppData\Local\Temp\d4f8127360d5cd7e1f6a10d3dfbba6d4.exe
  2⤵
  - Suspicious use of UnmapMainImage
  PID:2560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 12
    3⤵
    - Program crash
    PID:1764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2560 -ip 2560
1⤵
PID:5056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2560-7-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/4460-0-0x0000000000490000-0x0000000000572000-memory.dmp

Filesize
904KB

Download
memory/4460-1-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/4460-2-0x0000000005600000-0x0000000005BA4000-memory.dmp

Filesize
5.6MB

Download
memory/4460-3-0x0000000004F90000-0x0000000005022000-memory.dmp

Filesize
584KB

Download
memory/4460-4-0x0000000005220000-0x0000000005230000-memory.dmp

Filesize
64KB

Download
memory/4460-5-0x0000000004F70000-0x0000000004F7A000-memory.dmp

Filesize
40KB

Download
memory/4460-6-0x00000000051E0000-0x0000000005206000-memory.dmp

Filesize
152KB

Download
memory/4460-9-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download