raccoon | b1d7c8e59a48d655b56afd93586d2edc37dcd165bd909a77e100886716495db5

General

Target

1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe
Size

89KB
MD5

d0fa79fc637c5916da8d7c2f07948933
SHA1

d4fb639fe811739c4adf2e62b5df1f8c9ab35c75
SHA256

1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9
SHA512

68bca697a0cb607b6d813ddd4656afaa617384dbbafecda6b4f03685da8fba8603d761e0cb56841a778e59908064ff93261e80bc2f19f6898240d0b2dd65dd4c
SSDEEP

1536:2PX4YBLPitzZgglqlwEmnFN+br133phXZ4gDjyAKrsTBLviJYPx5OSbDU9oBdh02:ZzZggAlwEAAbryXsTBTiJYPx5OSbEoBN

Score

10^/10

raccoon 8401e21bbb0060afb24ce21fda90f5cb stealer

Malware Config

Extracted

Family

raccoon

Botnet

8401e21bbb0060afb24ce21fda90f5cb

C2

http://195.20.16.155:80

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2268-5-0x0000000001FD0000-0x0000000003FD0000-memory.dmp	family_raccoon_v2
behavioral1/memory/2600-10-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral1/memory/2600-8-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral1/memory/2600-13-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral1/memory/2600-16-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2

Suspicious use of SetThreadContext 1 IoCs

Processes:

1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe

description	pid	process	target process
PID 2268 set thread context of 2600	2268	1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe	RegAsm.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2544 2600 WerFault.exe RegAsm.exe

pid	pid_target	process	target process
2544	2600	WerFault.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exeRegAsm.exe

description	pid	process	target process
PID 2268 wrote to memory of 2600	2268	1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe	RegAsm.exe
PID 2268 wrote to memory of 2600	2268	1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe	RegAsm.exe
PID 2268 wrote to memory of 2600	2268	1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe	RegAsm.exe
PID 2268 wrote to memory of 2600	2268	1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe	RegAsm.exe
PID 2268 wrote to memory of 2600	2268	1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe	RegAsm.exe
PID 2268 wrote to memory of 2600	2268	1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe	RegAsm.exe
PID 2268 wrote to memory of 2600	2268	1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe	RegAsm.exe
PID 2268 wrote to memory of 2600	2268	1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe	RegAsm.exe
PID 2268 wrote to memory of 2600	2268	1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe	RegAsm.exe
PID 2268 wrote to memory of 2600	2268	1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe	RegAsm.exe
PID 2268 wrote to memory of 2600	2268	1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe	RegAsm.exe
PID 2268 wrote to memory of 2600	2268	1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe	RegAsm.exe
PID 2600 wrote to memory of 2544	2600	RegAsm.exe	WerFault.exe
PID 2600 wrote to memory of 2544	2600	RegAsm.exe	WerFault.exe
PID 2600 wrote to memory of 2544	2600	RegAsm.exe	WerFault.exe
PID 2600 wrote to memory of 2544	2600	RegAsm.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe
"C:\Users\Admin\AppData\Local\Temp\1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2268

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 252
3⤵
- Program crash
PID:2544

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2268-0-0x0000000000140000-0x000000000015C000-memory.dmp

Filesize
112KB

Download
memory/2268-2-0x0000000074670000-0x0000000074D5E000-memory.dmp

Filesize
6.9MB

Download
memory/2268-5-0x0000000001FD0000-0x0000000003FD0000-memory.dmp

Filesize
32.0MB

Download
memory/2268-14-0x0000000074670000-0x0000000074D5E000-memory.dmp

Filesize
6.9MB

Download
memory/2600-4-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2600-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2600-10-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2600-8-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2600-7-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2600-6-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2600-13-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2600-16-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads