Analysis
- max time kernel
147s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20240709-en - resource tags
- submitted
13/07/2024, 12:34
General
- Target 36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe
- Size 3.5MB
- Sample240713-prwbeashmf
- SHA256 36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805
Malware Config
Extracted
-
raccoon
-
071a7b18a42c1cd94de2fc5bb0bbcaf2
-
http://193.142.147.59:80
-
user_agent
DuckTales
Signatures
- Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
- Raccoon Stealer V2 payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe"C:\Users\Admin\AppData\Local\Temp\36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exeC:\Users\Admin\AppData\Local\Temp\36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805.exe2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2096-1336-0x0000000000400000-0x000000000040F000-memory.dmp
memory/2096-1338-0x0000000000400000-0x000000000040F000-memory.dmp
memory/5112-27-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-3-0x0000000074A40000-0x00000000751F1000-memory.dmp
memory/5112-11-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-47-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-67-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-65-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-61-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-59-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-57-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-55-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-53-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-51-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-49-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-43-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-41-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-39-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-37-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-35-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-33-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-31-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-23-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-0-0x0000000074A4E000-0x0000000074A4F000-memory.dmp
memory/5112-25-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-21-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-19-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-17-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-63-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-15-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-13-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-45-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-9-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-29-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-7-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-5-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-4-0x0000000004D60000-0x0000000004E27000-memory.dmp
memory/5112-1326-0x0000000074A40000-0x00000000751F1000-memory.dmp
memory/5112-1327-0x0000000004FC0000-0x0000000004FF2000-memory.dmp
memory/5112-1328-0x0000000005030000-0x000000000507C000-memory.dmp
memory/5112-1329-0x0000000005290000-0x0000000005322000-memory.dmp
memory/5112-1330-0x0000000005330000-0x0000000005396000-memory.dmp
memory/5112-1331-0x00000000059F0000-0x0000000005F96000-memory.dmp
memory/5112-1337-0x0000000074A40000-0x00000000751F1000-memory.dmp
memory/5112-2-0x0000000004D60000-0x0000000004E2C000-memory.dmp
memory/5112-1-0x0000000000080000-0x0000000000404000-memory.dmp