raccoon | a67e0fd85783e525a3bf49de0daa241f4d7dca55b04164a2bbb71acfdcb94176

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
12-04-2024 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

89KB
MD5

5f670b0585da1ea77525a49c669a7e5c
SHA1

7f43665d61a654fb36274c3019f650c74f8ad316
SHA256

a67e0fd85783e525a3bf49de0daa241f4d7dca55b04164a2bbb71acfdcb94176
SHA512

0e8a43930b0fed4a36a9098b7c53bb50a6020105c9c9e2b9ef1ea6117537b487a4ea435bf34521a538bc62f390d3782fbc3a42a732cc1e674a5bd90371660f41
SSDEEP

1536:J7Mj9V+6CfcSFzuX40XVfoenKY3iPCtbkMM2UhKikUGgb6Auf:e3JCfHo4iVfXKuiatbhM2UhKiygb56

Score

10^/10

raccoon 8401e21bbb0060afb24ce21fda90f5cb stealer

Malware Config

Extracted

Family

raccoon

Botnet

8401e21bbb0060afb24ce21fda90f5cb

http://195.20.16.155:80

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 4 IoCs

resource	yara_rule
behavioral2/memory/3684-4-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/4288-10-0x0000000002800000-0x0000000004800000-memory.dmp	family_raccoon_v2
behavioral2/memory/3684-9-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/3684-12-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4288 set thread context of 3684	4288	tmp.exe	79

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1488	3684	WerFault.exe	79

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 3684	4288	tmp.exe	79
PID 4288 wrote to memory of 3684	4288	tmp.exe	79
PID 4288 wrote to memory of 3684	4288	tmp.exe	79
PID 4288 wrote to memory of 3684	4288	tmp.exe	79
PID 4288 wrote to memory of 3684	4288	tmp.exe	79
PID 4288 wrote to memory of 3684	4288	tmp.exe	79
PID 4288 wrote to memory of 3684	4288	tmp.exe	79
PID 4288 wrote to memory of 3684	4288	tmp.exe	79

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 576
    3⤵
    - Program crash
    PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3684 -ip 3684
1⤵
PID:3704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3684-4-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3684-9-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3684-12-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4288-0-0x0000000000380000-0x000000000039C000-memory.dmp

Filesize
112KB

Download
memory/4288-1-0x00000000749B0000-0x0000000075160000-memory.dmp

Filesize
7.7MB

Download
memory/4288-8-0x00000000749B0000-0x0000000075160000-memory.dmp

Filesize
7.7MB

Download
memory/4288-10-0x0000000002800000-0x0000000004800000-memory.dmp

Filesize
32.0MB

Download
memory/4288-13-0x0000000002800000-0x0000000004800000-memory.dmp

Filesize
32.0MB

Download