raccoon | 5ca5180295a5c8f303c77d1a92915749bb464d7a53364fde60b177d103456a04

Analysis

max time kernel
146s
max time network
154s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Topaz Video AI.exe
Size

702.2MB
MD5

52c92decb851e99079c17568be886854
SHA1

f2f5dbfbd05a774da037415794e85cc99270148c
SHA256

8b69e17d0ee711d5e5c10118a9c5096997d44fff70d8e1b0dcc7802b181f6e87
SHA512

dd2a084bc974b5d7d8b8692b317c92cbe87aad39e99c8ada2e83c6fde25975faa6fd7bef744a719dd655f3f70fee1b380075872d7cc3c81f823db93d15aa29bd
SSDEEP

49152:MJ8U/HLU3Yp7dPM8V/HLU3Yp7CgUxK3h7/SEyIas8JWsa6HdLK:MJ8U/HQ3r8V/HQ3BbxKxD9jXsj9LK

Score

10^/10

raccoon dd188c0be5001b2c8fb76d74174694cd stealer

Malware Config

Extracted

Family

raccoon

Botnet

dd188c0be5001b2c8fb76d74174694cd

http://147.45.44.25:80/

http://85.28.47.116:80/

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 6 IoCs

resource	yara_rule
behavioral1/memory/2852-6-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2
behavioral1/memory/2852-12-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2
behavioral1/memory/2852-4-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2
behavioral1/memory/2852-10-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2
behavioral1/memory/3060-59-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2
behavioral1/memory/3032-73-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2

Suspicious use of SetThreadContext 12 IoCs

description	pid	Process	procid_target
PID 2436 set thread context of 2852	2436	Topaz Video AI.exe	30
PID 2436 set thread context of 1796	2436	Topaz Video AI.exe	33
PID 2436 set thread context of 2648	2436	Topaz Video AI.exe	35
PID 1980 set thread context of 3032	1980	Topaz Video AI.exe	38
PID 1980 set thread context of 3060	1980	Topaz Video AI.exe	40
PID 1980 set thread context of 624	1980	Topaz Video AI.exe	41
PID 2920 set thread context of 2448	2920	Topaz Video AI.exe	43
PID 2920 set thread context of 2288	2920	Topaz Video AI.exe	44
PID 2548 set thread context of 2204	2548	Topaz Video AI.exe	47
PID 2548 set thread context of 1400	2548	Topaz Video AI.exe	48
PID 2548 set thread context of 560	2548	Topaz Video AI.exe	49
PID 632 set thread context of 1620	632	Topaz Video AI.exe	51

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2164	2852	WerFault.exe	30
2656	1796	WerFault.exe	33
2304	2648	WerFault.exe	35

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2852	2436	Topaz Video AI.exe	30
PID 2436 wrote to memory of 2852	2436	Topaz Video AI.exe	30
PID 2436 wrote to memory of 2852	2436	Topaz Video AI.exe	30
PID 2436 wrote to memory of 2852	2436	Topaz Video AI.exe	30
PID 2436 wrote to memory of 2852	2436	Topaz Video AI.exe	30
PID 2436 wrote to memory of 2852	2436	Topaz Video AI.exe	30
PID 2436 wrote to memory of 2852	2436	Topaz Video AI.exe	30
PID 2436 wrote to memory of 2852	2436	Topaz Video AI.exe	30
PID 2436 wrote to memory of 2852	2436	Topaz Video AI.exe	30
PID 2436 wrote to memory of 2852	2436	Topaz Video AI.exe	30
PID 2852 wrote to memory of 2164	2852	Topaz Video AI.exe	31
PID 2852 wrote to memory of 2164	2852	Topaz Video AI.exe	31
PID 2852 wrote to memory of 2164	2852	Topaz Video AI.exe	31
PID 2852 wrote to memory of 2164	2852	Topaz Video AI.exe	31
PID 2436 wrote to memory of 1796	2436	Topaz Video AI.exe	33
PID 2436 wrote to memory of 1796	2436	Topaz Video AI.exe	33
PID 2436 wrote to memory of 1796	2436	Topaz Video AI.exe	33
PID 2436 wrote to memory of 1796	2436	Topaz Video AI.exe	33
PID 2436 wrote to memory of 1796	2436	Topaz Video AI.exe	33
PID 2436 wrote to memory of 1796	2436	Topaz Video AI.exe	33
PID 2436 wrote to memory of 1796	2436	Topaz Video AI.exe	33
PID 2436 wrote to memory of 1796	2436	Topaz Video AI.exe	33
PID 2436 wrote to memory of 1796	2436	Topaz Video AI.exe	33
PID 2436 wrote to memory of 1796	2436	Topaz Video AI.exe	33
PID 1796 wrote to memory of 2656	1796	Topaz Video AI.exe	34
PID 1796 wrote to memory of 2656	1796	Topaz Video AI.exe	34
PID 1796 wrote to memory of 2656	1796	Topaz Video AI.exe	34
PID 1796 wrote to memory of 2656	1796	Topaz Video AI.exe	34
PID 2436 wrote to memory of 2648	2436	Topaz Video AI.exe	35
PID 2436 wrote to memory of 2648	2436	Topaz Video AI.exe	35
PID 2436 wrote to memory of 2648	2436	Topaz Video AI.exe	35
PID 2436 wrote to memory of 2648	2436	Topaz Video AI.exe	35
PID 2436 wrote to memory of 2648	2436	Topaz Video AI.exe	35
PID 2436 wrote to memory of 2648	2436	Topaz Video AI.exe	35
PID 2436 wrote to memory of 2648	2436	Topaz Video AI.exe	35
PID 2436 wrote to memory of 2648	2436	Topaz Video AI.exe	35
PID 2436 wrote to memory of 2648	2436	Topaz Video AI.exe	35
PID 2436 wrote to memory of 2648	2436	Topaz Video AI.exe	35
PID 2648 wrote to memory of 2304	2648	Topaz Video AI.exe	36
PID 2648 wrote to memory of 2304	2648	Topaz Video AI.exe	36
PID 2648 wrote to memory of 2304	2648	Topaz Video AI.exe	36
PID 2648 wrote to memory of 2304	2648	Topaz Video AI.exe	36
PID 2436 wrote to memory of 1980	2436	Topaz Video AI.exe	37
PID 2436 wrote to memory of 1980	2436	Topaz Video AI.exe	37
PID 2436 wrote to memory of 1980	2436	Topaz Video AI.exe	37
PID 2436 wrote to memory of 1980	2436	Topaz Video AI.exe	37
PID 1980 wrote to memory of 3032	1980	Topaz Video AI.exe	38
PID 1980 wrote to memory of 3032	1980	Topaz Video AI.exe	38
PID 1980 wrote to memory of 3032	1980	Topaz Video AI.exe	38
PID 1980 wrote to memory of 3032	1980	Topaz Video AI.exe	38
PID 1980 wrote to memory of 3032	1980	Topaz Video AI.exe	38
PID 1980 wrote to memory of 3032	1980	Topaz Video AI.exe	38
PID 1980 wrote to memory of 3032	1980	Topaz Video AI.exe	38
PID 1980 wrote to memory of 3032	1980	Topaz Video AI.exe	38
PID 1980 wrote to memory of 3032	1980	Topaz Video AI.exe	38
PID 1980 wrote to memory of 3032	1980	Topaz Video AI.exe	38
PID 1980 wrote to memory of 3060	1980	Topaz Video AI.exe	40
PID 1980 wrote to memory of 3060	1980	Topaz Video AI.exe	40
PID 1980 wrote to memory of 3060	1980	Topaz Video AI.exe	40
PID 1980 wrote to memory of 3060	1980	Topaz Video AI.exe	40
PID 1980 wrote to memory of 3060	1980	Topaz Video AI.exe	40
PID 1980 wrote to memory of 3060	1980	Topaz Video AI.exe	40
PID 1980 wrote to memory of 3060	1980	Topaz Video AI.exe	40
PID 1980 wrote to memory of 3060	1980	Topaz Video AI.exe	40

C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
"C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
  "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 120
    3⤵
    - Program crash
    PID:2164
- C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
  "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 120
    3⤵
    - Program crash
    PID:2656
- C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
  "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 120
    3⤵
    - Program crash
    PID:2304
- C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
  "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
    "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
    3⤵
    PID:3032
- - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
    "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
    3⤵
    PID:3060
- - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
    "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
    3⤵
    PID:624
- - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
    "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
    3⤵
    - Suspicious use of SetThreadContext
    PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
      "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
      4⤵
      PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
      "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
      4⤵
      PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
      "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
      4⤵
      Suspicious use of SetThreadContext
      PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
        5⤵
        
        PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
        5⤵
        
        PID:1400
    - - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
        5⤵
        
        PID:560
    - - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
        5⤵
        Suspicious use of SetThreadContext
        
        PID:632
      - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
        6⤵
        
        PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2852-0-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/2852-6-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/2852-12-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/2852-4-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/2852-2-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/2852-10-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/2852-1-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/2852-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3032-44-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3032-73-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/3060-59-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download