raccoon | 36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13-07-2024 12:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe
Size

3.5MB
MD5

4695f98bf6e8c0908c0b6af77ec31a6c
SHA1

41b05253a583238d6c583a97eb6d45e92607f53d
SHA256

36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805
SHA512

b85d91a68c514e2e27d0a1b72aa7d12abed855953944eb2ab7a723a9770972b94434416a2415fc46a3aee516642121329b22eb61f80fc760d011da0ce4acfb30
SSDEEP

24576:Pam/O3RT2048qUkeSLdnC/sGB9D/YBl7B3Yom6pd+e6idu6sN6FCBfcW877++aIS:PaZ3Rb4UScABl7B3YH6pd+e6i

Score

10^/10

raccoon 071a7b18a42c1cd94de2fc5bb0bbcaf2 stealer

Malware Config

Extracted

Family

raccoon

Botnet

071a7b18a42c1cd94de2fc5bb0bbcaf2

http://193.142.147.59:80

Attributes

user_agent
DuckTales

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4212-1336-0x0000000000400000-0x000000000040F000-memory.dmp	family_raccoon_v2
behavioral1/memory/4212-1338-0x0000000000400000-0x000000000040F000-memory.dmp	family_raccoon_v2

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4856 set thread context of 4212	4856	36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe	87

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 4212	4856	36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe	87
PID 4856 wrote to memory of 4212	4856	36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe	87
PID 4856 wrote to memory of 4212	4856	36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe	87
PID 4856 wrote to memory of 4212	4856	36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe	87
PID 4856 wrote to memory of 4212	4856	36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe	87
PID 4856 wrote to memory of 4212	4856	36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe	87
PID 4856 wrote to memory of 4212	4856	36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe	87
PID 4856 wrote to memory of 4212	4856	36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe	87

C:\Users\Admin\AppData\Local\Temp\36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe
"C:\Users\Admin\AppData\Local\Temp\36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Users\Admin\AppData\Local\Temp\36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe
  C:\Users\Admin\AppData\Local\Temp\36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe
  2⤵
  PID:4212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4212-1336-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4212-1338-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4856-38-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-28-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-40-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-36-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-24-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-10-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-8-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-3-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-66-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-64-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-0-0x000000007448E000-0x000000007448F000-memory.dmp

Filesize
4KB

Download
memory/4856-58-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-34-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-54-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-52-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-50-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-48-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-46-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-44-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-42-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-62-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-60-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-56-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-32-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-30-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-26-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-22-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-20-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-18-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-17-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-14-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-12-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-6-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-4-0x0000000005290000-0x0000000005357000-memory.dmp

Filesize
796KB

Download
memory/4856-69-0x0000000074480000-0x0000000074C30000-memory.dmp

Filesize
7.7MB

Download
memory/4856-1326-0x0000000074480000-0x0000000074C30000-memory.dmp

Filesize
7.7MB

Download
memory/4856-1327-0x0000000005360000-0x0000000005392000-memory.dmp

Filesize
200KB

Download
memory/4856-1328-0x00000000053D0000-0x000000000541C000-memory.dmp

Filesize
304KB

Download
memory/4856-1329-0x0000000005630000-0x00000000056C2000-memory.dmp

Filesize
584KB

Download
memory/4856-1330-0x00000000056D0000-0x0000000005736000-memory.dmp

Filesize
408KB

Download
memory/4856-1331-0x0000000005D90000-0x0000000006334000-memory.dmp

Filesize
5.6MB

Download
memory/4856-2-0x0000000005290000-0x000000000535C000-memory.dmp

Filesize
816KB

Download
memory/4856-1337-0x0000000074480000-0x0000000074C30000-memory.dmp

Filesize
7.7MB

Download
memory/4856-1-0x00000000003A0000-0x0000000000724000-memory.dmp

Filesize
3.5MB

Download