raccoon | 3898534fa62f5a8f169c66900f183e5637e7c4f9be8c46591568ff489bc432d4

Analysis

max time kernel
124s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07-07-2024 12:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vb72c2.exe
Size

1.0MB
MD5

f7f6eb480fe715733e509d0489171c18
SHA1

e28a03d8c62eae2687d8d8f6b6ccb73377bc1a48
SHA256

3898534fa62f5a8f169c66900f183e5637e7c4f9be8c46591568ff489bc432d4
SHA512

962a440c8b5e148821e5db065bddcf861899667319ff1d3ad497e7629c6212235e51d1902d4685af6248f83f7c4a8a1c2dc9805f58c5a27a87a40067e5792988
SSDEEP

24576:BW9a/w9mj+Nhf+x+eswsX08cjwPBXMX7pCeg8nr5G79Bgx+:BWYWNQUe3sX0OPuXV1vnAwx+

Score

10^/10

raccoon 23b7de51bb42a569733f1e26dbce63ba stealer upx

Malware Config

Extracted

Family

raccoon

Botnet

23b7de51bb42a569733f1e26dbce63ba

http://95.169.205.186:80/

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 3 IoCs

resource	yara_rule
behavioral3/memory/2868-1-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral3/memory/2868-4-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral3/memory/2868-6-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/memory/4252-0-0x00007FF7291D0000-0x00007FF7294AE000-memory.dmp	upx
behavioral3/memory/4252-2-0x00007FF7291D0000-0x00007FF7294AE000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4252 set thread context of 2868	4252	vb72c2.exe	94

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4384	2868	WerFault.exe	94

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4252	vb72c2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 2868	4252	vb72c2.exe	94
PID 4252 wrote to memory of 2868	4252	vb72c2.exe	94
PID 4252 wrote to memory of 2868	4252	vb72c2.exe	94
PID 4252 wrote to memory of 2868	4252	vb72c2.exe	94
PID 4252 wrote to memory of 2868	4252	vb72c2.exe	94
PID 4252 wrote to memory of 2868	4252	vb72c2.exe	94
PID 4252 wrote to memory of 2868	4252	vb72c2.exe	94
PID 4252 wrote to memory of 2868	4252	vb72c2.exe	94

C:\Users\Admin\AppData\Local\Temp\vb72c2.exe
"C:\Users\Admin\AppData\Local\Temp\vb72c2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
  2⤵
  PID:2868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 572
    3⤵
    - Program crash
    PID:4384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4088,i,8550138573348074061,7308779696487990535,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:8
1⤵
PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2868 -ip 2868
1⤵
PID:4740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2868-1-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2868-4-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2868-6-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4252-0-0x00007FF7291D0000-0x00007FF7294AE000-memory.dmp

Filesize
2.9MB

Download
memory/4252-2-0x00007FF7291D0000-0x00007FF7294AE000-memory.dmp

Filesize
2.9MB

Download