raccoon | 5f4c117cd7f2a02006da52cd5725d8c2579d2cab1fa8a1dd85faaab47fd04ecb

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2024 10:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f4c117cd7f2a02006da52cd5725d8c2579d2cab1fa8a1dd85faaab47fd04ecb_NeikiAnalytics.exe
Size

494KB
MD5

1fd4e62013aa31b99b3db397b6db9ce0
SHA1

8d3baf8e1f19bd44903afa2cdb87a4d31fb4a938
SHA256

5f4c117cd7f2a02006da52cd5725d8c2579d2cab1fa8a1dd85faaab47fd04ecb
SHA512

42215bba99a745ae1778b4f6296db0142ce25ea546fc59c8f3820ba00b486e26b2308819e4e44d994aad1dd42a975d6b75ed1cbbbc7e21c1e01df5a7cd5d2ae5
SSDEEP

12288:IrFu5n+lFTv5qVxivxwJrsdbvutQdaEsBu:I45n2v8VxGwJkbvutLEsBu

Score

10^/10

raccoon 5d224fd6c26c50ca4fea125e43d52eff1b8373e6 stealer

Malware Config

Extracted

Family

raccoon

Botnet

5d224fd6c26c50ca4fea125e43d52eff1b8373e6

Attributes

url4cnc
https://drive.google.com/uc?export=download&id=1qOwjltN62v2z1O2ar8qbu8ru2QwxaRnr

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 5 IoCs

resource	yara_rule
behavioral2/memory/4360-2-0x00000000021A0000-0x000000000222E000-memory.dmp	family_raccoon_v1
behavioral2/memory/4360-3-0x0000000000400000-0x0000000000490000-memory.dmp	family_raccoon_v1
behavioral2/memory/4360-4-0x0000000000400000-0x000000000052A000-memory.dmp	family_raccoon_v1
behavioral2/memory/4360-6-0x0000000000400000-0x0000000000490000-memory.dmp	family_raccoon_v1
behavioral2/memory/4360-5-0x00000000021A0000-0x000000000222E000-memory.dmp	family_raccoon_v1

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
24	drive.google.com
25	drive.google.com

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4760	4360	WerFault.exe	81

C:\Users\Admin\AppData\Local\Temp\5f4c117cd7f2a02006da52cd5725d8c2579d2cab1fa8a1dd85faaab47fd04ecb_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5f4c117cd7f2a02006da52cd5725d8c2579d2cab1fa8a1dd85faaab47fd04ecb_NeikiAnalytics.exe"
1⤵
PID:4360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 1212
  2⤵
  - Program crash
  PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4360 -ip 4360
1⤵
PID:692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4360-1-0x0000000000800000-0x0000000000900000-memory.dmp

Filesize
1024KB

Download
memory/4360-2-0x00000000021A0000-0x000000000222E000-memory.dmp

Filesize
568KB

Download
memory/4360-3-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/4360-4-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/4360-6-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/4360-5-0x00000000021A0000-0x000000000222E000-memory.dmp

Filesize
568KB

Download