raccoon | 1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9

General

Target

SecuriteInfo.com.Variant.Lazy.509335.4668.31067.exe
Size

89KB
MD5

d0fa79fc637c5916da8d7c2f07948933
SHA1

d4fb639fe811739c4adf2e62b5df1f8c9ab35c75
SHA256

1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9
SHA512

68bca697a0cb607b6d813ddd4656afaa617384dbbafecda6b4f03685da8fba8603d761e0cb56841a778e59908064ff93261e80bc2f19f6898240d0b2dd65dd4c
SSDEEP

1536:2PX4YBLPitzZgglqlwEmnFN+br133phXZ4gDjyAKrsTBLviJYPx5OSbDU9oBdh02:ZzZggAlwEAAbryXsTBTiJYPx5OSbEoBN

Score

10^/10

raccoon 8401e21bbb0060afb24ce21fda90f5cb stealer

Malware Config

Extracted

Family

raccoon

Botnet

8401e21bbb0060afb24ce21fda90f5cb

C2

http://195.20.16.155:80

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 5 IoCs

resource	yara_rule
behavioral1/memory/1968-6-0x00000000022F0000-0x00000000042F0000-memory.dmp	family_raccoon_v2
behavioral1/memory/2252-8-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral1/memory/2252-10-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral1/memory/2252-13-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral1/memory/2252-16-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1968 set thread context of 2252	1968	SecuriteInfo.com.Variant.Lazy.509335.4668.31067.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2824	2252	WerFault.exe	30

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2316	1968	SecuriteInfo.com.Variant.Lazy.509335.4668.31067.exe	29
PID 1968 wrote to memory of 2316	1968	SecuriteInfo.com.Variant.Lazy.509335.4668.31067.exe	29
PID 1968 wrote to memory of 2316	1968	SecuriteInfo.com.Variant.Lazy.509335.4668.31067.exe	29
PID 1968 wrote to memory of 2316	1968	SecuriteInfo.com.Variant.Lazy.509335.4668.31067.exe	29
PID 1968 wrote to memory of 2316	1968	SecuriteInfo.com.Variant.Lazy.509335.4668.31067.exe	29
PID 1968 wrote to memory of 2316	1968	SecuriteInfo.com.Variant.Lazy.509335.4668.31067.exe	29
PID 1968 wrote to memory of 2316	1968	SecuriteInfo.com.Variant.Lazy.509335.4668.31067.exe	29
PID 1968 wrote to memory of 2252	1968	SecuriteInfo.com.Variant.Lazy.509335.4668.31067.exe	30
PID 1968 wrote to memory of 2252	1968	SecuriteInfo.com.Variant.Lazy.509335.4668.31067.exe	30
PID 1968 wrote to memory of 2252	1968	SecuriteInfo.com.Variant.Lazy.509335.4668.31067.exe	30
PID 1968 wrote to memory of 2252	1968	SecuriteInfo.com.Variant.Lazy.509335.4668.31067.exe	30
PID 1968 wrote to memory of 2252	1968	SecuriteInfo.com.Variant.Lazy.509335.4668.31067.exe	30
PID 1968 wrote to memory of 2252	1968	SecuriteInfo.com.Variant.Lazy.509335.4668.31067.exe	30
PID 1968 wrote to memory of 2252	1968	SecuriteInfo.com.Variant.Lazy.509335.4668.31067.exe	30
PID 1968 wrote to memory of 2252	1968	SecuriteInfo.com.Variant.Lazy.509335.4668.31067.exe	30
PID 1968 wrote to memory of 2252	1968	SecuriteInfo.com.Variant.Lazy.509335.4668.31067.exe	30
PID 1968 wrote to memory of 2252	1968	SecuriteInfo.com.Variant.Lazy.509335.4668.31067.exe	30
PID 1968 wrote to memory of 2252	1968	SecuriteInfo.com.Variant.Lazy.509335.4668.31067.exe	30
PID 1968 wrote to memory of 2252	1968	SecuriteInfo.com.Variant.Lazy.509335.4668.31067.exe	30
PID 2252 wrote to memory of 2824	2252	RegAsm.exe	31
PID 2252 wrote to memory of 2824	2252	RegAsm.exe	31
PID 2252 wrote to memory of 2824	2252	RegAsm.exe	31
PID 2252 wrote to memory of 2824	2252	RegAsm.exe	31

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.509335.4668.31067.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.509335.4668.31067.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2316
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 256
    3⤵
    - Program crash
    PID:2824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-0-0x00000000003D0000-0x00000000003EC000-memory.dmp

Filesize
112KB

Download
memory/1968-1-0x0000000074D20000-0x000000007540E000-memory.dmp

Filesize
6.9MB

Download
memory/1968-6-0x00000000022F0000-0x00000000042F0000-memory.dmp

Filesize
32.0MB

Download
memory/1968-14-0x0000000074D20000-0x000000007540E000-memory.dmp

Filesize
6.9MB

Download
memory/2252-4-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2252-7-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2252-5-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2252-8-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2252-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2252-10-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2252-13-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2252-16-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing