raccoon | 3898534fa62f5a8f169c66900f183e5637e7c4f9be8c46591568ff489bc432d4

Analysis

max time kernel
91s
max time network
105s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
07-07-2024 12:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vb72c2.exe
Size

1.0MB
MD5

f7f6eb480fe715733e509d0489171c18
SHA1

e28a03d8c62eae2687d8d8f6b6ccb73377bc1a48
SHA256

3898534fa62f5a8f169c66900f183e5637e7c4f9be8c46591568ff489bc432d4
SHA512

962a440c8b5e148821e5db065bddcf861899667319ff1d3ad497e7629c6212235e51d1902d4685af6248f83f7c4a8a1c2dc9805f58c5a27a87a40067e5792988
SSDEEP

24576:BW9a/w9mj+Nhf+x+eswsX08cjwPBXMX7pCeg8nr5G79Bgx+:BWYWNQUe3sX0OPuXV1vnAwx+

Score

10^/10

raccoon 23b7de51bb42a569733f1e26dbce63ba stealer upx

Malware Config

Extracted

Family

raccoon

Botnet

23b7de51bb42a569733f1e26dbce63ba

http://95.169.205.186:80/

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 3 IoCs

resource	yara_rule
behavioral4/memory/3124-1-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral4/memory/3124-6-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral4/memory/3124-4-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/memory/4360-0-0x00007FF7DC130000-0x00007FF7DC40E000-memory.dmp	upx
behavioral4/memory/4360-2-0x00007FF7DC130000-0x00007FF7DC40E000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4360 set thread context of 3124	4360	vb72c2.exe	79

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2212	3124	WerFault.exe	79

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4360	vb72c2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 3124	4360	vb72c2.exe	79
PID 4360 wrote to memory of 3124	4360	vb72c2.exe	79
PID 4360 wrote to memory of 3124	4360	vb72c2.exe	79
PID 4360 wrote to memory of 3124	4360	vb72c2.exe	79
PID 4360 wrote to memory of 3124	4360	vb72c2.exe	79
PID 4360 wrote to memory of 3124	4360	vb72c2.exe	79
PID 4360 wrote to memory of 3124	4360	vb72c2.exe	79
PID 4360 wrote to memory of 3124	4360	vb72c2.exe	79

C:\Users\Admin\AppData\Local\Temp\vb72c2.exe
"C:\Users\Admin\AppData\Local\Temp\vb72c2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
  2⤵
  PID:3124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 440
    3⤵
    - Program crash
    PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3124 -ip 3124
1⤵
PID:2332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3124-1-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3124-6-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3124-4-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4360-0-0x00007FF7DC130000-0x00007FF7DC40E000-memory.dmp

Filesize
2.9MB

Download
memory/4360-2-0x00007FF7DC130000-0x00007FF7DC40E000-memory.dmp

Filesize
2.9MB

Download