raccoon | 36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
13-07-2024 12:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe
Size

3.5MB
MD5

4695f98bf6e8c0908c0b6af77ec31a6c
SHA1

41b05253a583238d6c583a97eb6d45e92607f53d
SHA256

36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805
SHA512

b85d91a68c514e2e27d0a1b72aa7d12abed855953944eb2ab7a723a9770972b94434416a2415fc46a3aee516642121329b22eb61f80fc760d011da0ce4acfb30
SSDEEP

24576:Pam/O3RT2048qUkeSLdnC/sGB9D/YBl7B3Yom6pd+e6idu6sN6FCBfcW877++aIS:PaZ3Rb4UScABl7B3YH6pd+e6i

Score

10^/10

raccoon 071a7b18a42c1cd94de2fc5bb0bbcaf2 stealer

Malware Config

Extracted

Family

raccoon

Botnet

071a7b18a42c1cd94de2fc5bb0bbcaf2

http://193.142.147.59:80

Attributes

user_agent
DuckTales

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 2 IoCs

resource	yara_rule
behavioral2/memory/2096-1336-0x0000000000400000-0x000000000040F000-memory.dmp	family_raccoon_v2
behavioral2/memory/2096-1338-0x0000000000400000-0x000000000040F000-memory.dmp	family_raccoon_v2

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5112 set thread context of 2096	5112	36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe	83

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5112	36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 2096	5112	36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe	83
PID 5112 wrote to memory of 2096	5112	36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe	83
PID 5112 wrote to memory of 2096	5112	36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe	83
PID 5112 wrote to memory of 2096	5112	36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe	83
PID 5112 wrote to memory of 2096	5112	36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe	83
PID 5112 wrote to memory of 2096	5112	36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe	83
PID 5112 wrote to memory of 2096	5112	36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe	83
PID 5112 wrote to memory of 2096	5112	36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe	83

C:\Users\Admin\AppData\Local\Temp\36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe
"C:\Users\Admin\AppData\Local\Temp\36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Users\Admin\AppData\Local\Temp\36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe
  C:\Users\Admin\AppData\Local\Temp\36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe
  2⤵
  PID:2096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2096-1336-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2096-1338-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/5112-27-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-47-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-11-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-25-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-67-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-65-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-61-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-59-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-57-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-55-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-0-0x0000000074A4E000-0x0000000074A4F000-memory.dmp

Filesize
4KB

Download
memory/5112-51-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-23-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-43-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-41-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-39-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-37-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-35-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-33-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-31-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-53-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-3-0x0000000074A40000-0x00000000751F1000-memory.dmp

Filesize
7.7MB

Download
memory/5112-49-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-21-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-19-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-17-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-63-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-15-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-13-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-45-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-9-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-29-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-7-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-5-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-4-0x0000000004D60000-0x0000000004E27000-memory.dmp

Filesize
796KB

Download
memory/5112-1326-0x0000000074A40000-0x00000000751F1000-memory.dmp

Filesize
7.7MB

Download
memory/5112-1327-0x0000000004FC0000-0x0000000004FF2000-memory.dmp

Filesize
200KB

Download
memory/5112-1328-0x0000000005030000-0x000000000507C000-memory.dmp

Filesize
304KB

Download
memory/5112-1329-0x0000000005290000-0x0000000005322000-memory.dmp

Filesize
584KB

Download
memory/5112-1330-0x0000000005330000-0x0000000005396000-memory.dmp

Filesize
408KB

Download
memory/5112-1331-0x00000000059F0000-0x0000000005F96000-memory.dmp

Filesize
5.6MB

Download
memory/5112-1337-0x0000000074A40000-0x00000000751F1000-memory.dmp

Filesize
7.7MB

Download
memory/5112-2-0x0000000004D60000-0x0000000004E2C000-memory.dmp

Filesize
816KB

Download
memory/5112-1-0x0000000000080000-0x0000000000404000-memory.dmp

Filesize
3.5MB

Download