raccoon | 1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
12-04-2024 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Variant.Lazy.509335.4668.exe
Size

89KB
MD5

d0fa79fc637c5916da8d7c2f07948933
SHA1

d4fb639fe811739c4adf2e62b5df1f8c9ab35c75
SHA256

1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9
SHA512

68bca697a0cb607b6d813ddd4656afaa617384dbbafecda6b4f03685da8fba8603d761e0cb56841a778e59908064ff93261e80bc2f19f6898240d0b2dd65dd4c
SSDEEP

1536:2PX4YBLPitzZgglqlwEmnFN+br133phXZ4gDjyAKrsTBLviJYPx5OSbDU9oBdh02:ZzZggAlwEAAbryXsTBTiJYPx5OSbEoBN

Score

10^/10

raccoon 8401e21bbb0060afb24ce21fda90f5cb stealer

Malware Config

Extracted

Family

raccoon

Botnet

8401e21bbb0060afb24ce21fda90f5cb

http://195.20.16.155:80

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 4 IoCs

resource	yara_rule
behavioral2/memory/3104-4-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/3104-8-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/3104-12-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/2984-11-0x0000000002C10000-0x0000000004C10000-memory.dmp	family_raccoon_v2

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2984 set thread context of 3104	2984	SecuriteInfo.com.Variant.Lazy.509335.4668.exe	84

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4700	3104	WerFault.exe	84

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 3104	2984	SecuriteInfo.com.Variant.Lazy.509335.4668.exe	84
PID 2984 wrote to memory of 3104	2984	SecuriteInfo.com.Variant.Lazy.509335.4668.exe	84
PID 2984 wrote to memory of 3104	2984	SecuriteInfo.com.Variant.Lazy.509335.4668.exe	84
PID 2984 wrote to memory of 3104	2984	SecuriteInfo.com.Variant.Lazy.509335.4668.exe	84
PID 2984 wrote to memory of 3104	2984	SecuriteInfo.com.Variant.Lazy.509335.4668.exe	84
PID 2984 wrote to memory of 3104	2984	SecuriteInfo.com.Variant.Lazy.509335.4668.exe	84
PID 2984 wrote to memory of 3104	2984	SecuriteInfo.com.Variant.Lazy.509335.4668.exe	84
PID 2984 wrote to memory of 3104	2984	SecuriteInfo.com.Variant.Lazy.509335.4668.exe	84

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.509335.4668.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.509335.4668.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 576
    3⤵
    - Program crash
    PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3104 -ip 3104
1⤵
PID:3840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2984-0-0x0000000000800000-0x000000000081C000-memory.dmp

Filesize
112KB

Download
memory/2984-2-0x0000000074A20000-0x00000000751D0000-memory.dmp

Filesize
7.7MB

Download
memory/2984-10-0x0000000074A20000-0x00000000751D0000-memory.dmp

Filesize
7.7MB

Download
memory/2984-11-0x0000000002C10000-0x0000000004C10000-memory.dmp

Filesize
32.0MB

Download
memory/2984-13-0x0000000002C10000-0x0000000004C10000-memory.dmp

Filesize
32.0MB

Download
memory/3104-4-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3104-8-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3104-12-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download