raccoon | 3898534fa62f5a8f169c66900f183e5637e7c4f9be8c46591568ff489bc432d4

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06-07-2024 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f7f6eb480fe715733e509d0489171c18.exe
Size

1.0MB
MD5

f7f6eb480fe715733e509d0489171c18
SHA1

e28a03d8c62eae2687d8d8f6b6ccb73377bc1a48
SHA256

3898534fa62f5a8f169c66900f183e5637e7c4f9be8c46591568ff489bc432d4
SHA512

962a440c8b5e148821e5db065bddcf861899667319ff1d3ad497e7629c6212235e51d1902d4685af6248f83f7c4a8a1c2dc9805f58c5a27a87a40067e5792988
SSDEEP

24576:BW9a/w9mj+Nhf+x+eswsX08cjwPBXMX7pCeg8nr5G79Bgx+:BWYWNQUe3sX0OPuXV1vnAwx+

Score

10^/10

raccoon 23b7de51bb42a569733f1e26dbce63ba stealer upx

Malware Config

Extracted

Family

raccoon

Botnet

23b7de51bb42a569733f1e26dbce63ba

http://95.169.205.186:80/

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 3 IoCs

resource	yara_rule
behavioral2/memory/4876-1-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/4876-5-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/4876-7-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5100-0-0x00007FF7397A0000-0x00007FF739A7E000-memory.dmp	upx
behavioral2/memory/5100-3-0x00007FF7397A0000-0x00007FF739A7E000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5100 set thread context of 4876	5100	f7f6eb480fe715733e509d0489171c18.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1020	4876	WerFault.exe	87

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5100	f7f6eb480fe715733e509d0489171c18.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 4944	5100	f7f6eb480fe715733e509d0489171c18.exe	86
PID 5100 wrote to memory of 4944	5100	f7f6eb480fe715733e509d0489171c18.exe	86
PID 5100 wrote to memory of 4944	5100	f7f6eb480fe715733e509d0489171c18.exe	86
PID 5100 wrote to memory of 4876	5100	f7f6eb480fe715733e509d0489171c18.exe	87
PID 5100 wrote to memory of 4876	5100	f7f6eb480fe715733e509d0489171c18.exe	87
PID 5100 wrote to memory of 4876	5100	f7f6eb480fe715733e509d0489171c18.exe	87
PID 5100 wrote to memory of 4876	5100	f7f6eb480fe715733e509d0489171c18.exe	87
PID 5100 wrote to memory of 4876	5100	f7f6eb480fe715733e509d0489171c18.exe	87
PID 5100 wrote to memory of 4876	5100	f7f6eb480fe715733e509d0489171c18.exe	87
PID 5100 wrote to memory of 4876	5100	f7f6eb480fe715733e509d0489171c18.exe	87
PID 5100 wrote to memory of 4876	5100	f7f6eb480fe715733e509d0489171c18.exe	87

C:\Users\Admin\AppData\Local\Temp\f7f6eb480fe715733e509d0489171c18.exe
"C:\Users\Admin\AppData\Local\Temp\f7f6eb480fe715733e509d0489171c18.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
  2⤵
  PID:4944
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
  2⤵
  PID:4876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 576
    3⤵
    - Program crash
    PID:1020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 4876 -ip 4876
1⤵
PID:4524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4876-1-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4876-5-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4876-7-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/5100-0-0x00007FF7397A0000-0x00007FF739A7E000-memory.dmp

Filesize
2.9MB

Download
memory/5100-3-0x00007FF7397A0000-0x00007FF739A7E000-memory.dmp

Filesize
2.9MB

Download