raccoon | 5ca5180295a5c8f303c77d1a92915749bb464d7a53364fde60b177d103456a04

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Topaz Video AI.exe
Size

702.2MB
MD5

52c92decb851e99079c17568be886854
SHA1

f2f5dbfbd05a774da037415794e85cc99270148c
SHA256

8b69e17d0ee711d5e5c10118a9c5096997d44fff70d8e1b0dcc7802b181f6e87
SHA512

dd2a084bc974b5d7d8b8692b317c92cbe87aad39e99c8ada2e83c6fde25975faa6fd7bef744a719dd655f3f70fee1b380075872d7cc3c81f823db93d15aa29bd
SSDEEP

49152:MJ8U/HLU3Yp7dPM8V/HLU3Yp7CgUxK3h7/SEyIas8JWsa6HdLK:MJ8U/HQ3r8V/HQ3BbxKxD9jXsj9LK

Score

10^/10

raccoon dd188c0be5001b2c8fb76d74174694cd stealer

Malware Config

Extracted

Family

raccoon

Botnet

dd188c0be5001b2c8fb76d74174694cd

http://147.45.44.25:80/

http://85.28.47.116:80/

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 5 IoCs

resource	yara_rule
behavioral2/memory/5052-0-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2
behavioral2/memory/5052-2-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2
behavioral2/memory/1916-6-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2
behavioral2/memory/5052-10-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2
behavioral2/memory/2228-14-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2

Suspicious use of SetThreadContext 12 IoCs

description	pid	Process	procid_target
PID 2288 set thread context of 5052	2288	Topaz Video AI.exe	88
PID 2288 set thread context of 1916	2288	Topaz Video AI.exe	89
PID 2288 set thread context of 4304	2288	Topaz Video AI.exe	91
PID 2288 set thread context of 2228	2288	Topaz Video AI.exe	92
PID 3328 set thread context of 4856	3328	Topaz Video AI.exe	95
PID 3328 set thread context of 2404	3328	Topaz Video AI.exe	96
PID 3328 set thread context of 2592	3328	Topaz Video AI.exe	97
PID 3328 set thread context of 1044	3328	Topaz Video AI.exe	98
PID 3328 set thread context of 2324	3328	Topaz Video AI.exe	99
PID 3328 set thread context of 1480	3328	Topaz Video AI.exe	100
PID 3328 set thread context of 644	3328	Topaz Video AI.exe	101
PID 3328 set thread context of 1728	3328	Topaz Video AI.exe	102

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 1856	3572	Topaz Video AI.exe	84
PID 3572 wrote to memory of 1856	3572	Topaz Video AI.exe	84
PID 3572 wrote to memory of 1856	3572	Topaz Video AI.exe	84
PID 1856 wrote to memory of 2288	1856	Topaz Video AI.exe	85
PID 1856 wrote to memory of 2288	1856	Topaz Video AI.exe	85
PID 1856 wrote to memory of 2288	1856	Topaz Video AI.exe	85
PID 2288 wrote to memory of 5052	2288	Topaz Video AI.exe	88
PID 2288 wrote to memory of 5052	2288	Topaz Video AI.exe	88
PID 2288 wrote to memory of 5052	2288	Topaz Video AI.exe	88
PID 2288 wrote to memory of 5052	2288	Topaz Video AI.exe	88
PID 2288 wrote to memory of 5052	2288	Topaz Video AI.exe	88
PID 2288 wrote to memory of 5052	2288	Topaz Video AI.exe	88
PID 2288 wrote to memory of 5052	2288	Topaz Video AI.exe	88
PID 2288 wrote to memory of 5052	2288	Topaz Video AI.exe	88
PID 2288 wrote to memory of 5052	2288	Topaz Video AI.exe	88
PID 2288 wrote to memory of 1916	2288	Topaz Video AI.exe	89
PID 2288 wrote to memory of 1916	2288	Topaz Video AI.exe	89
PID 2288 wrote to memory of 1916	2288	Topaz Video AI.exe	89
PID 2288 wrote to memory of 1916	2288	Topaz Video AI.exe	89
PID 2288 wrote to memory of 1916	2288	Topaz Video AI.exe	89
PID 2288 wrote to memory of 1916	2288	Topaz Video AI.exe	89
PID 2288 wrote to memory of 1916	2288	Topaz Video AI.exe	89
PID 2288 wrote to memory of 1916	2288	Topaz Video AI.exe	89
PID 2288 wrote to memory of 1916	2288	Topaz Video AI.exe	89
PID 2288 wrote to memory of 4304	2288	Topaz Video AI.exe	91
PID 2288 wrote to memory of 4304	2288	Topaz Video AI.exe	91
PID 2288 wrote to memory of 4304	2288	Topaz Video AI.exe	91
PID 2288 wrote to memory of 4304	2288	Topaz Video AI.exe	91
PID 2288 wrote to memory of 4304	2288	Topaz Video AI.exe	91
PID 2288 wrote to memory of 4304	2288	Topaz Video AI.exe	91
PID 2288 wrote to memory of 4304	2288	Topaz Video AI.exe	91
PID 2288 wrote to memory of 4304	2288	Topaz Video AI.exe	91
PID 2288 wrote to memory of 4304	2288	Topaz Video AI.exe	91
PID 2288 wrote to memory of 2228	2288	Topaz Video AI.exe	92
PID 2288 wrote to memory of 2228	2288	Topaz Video AI.exe	92
PID 2288 wrote to memory of 2228	2288	Topaz Video AI.exe	92
PID 2288 wrote to memory of 2228	2288	Topaz Video AI.exe	92
PID 2288 wrote to memory of 2228	2288	Topaz Video AI.exe	92
PID 2288 wrote to memory of 2228	2288	Topaz Video AI.exe	92
PID 2288 wrote to memory of 2228	2288	Topaz Video AI.exe	92
PID 2288 wrote to memory of 2228	2288	Topaz Video AI.exe	92
PID 2288 wrote to memory of 2228	2288	Topaz Video AI.exe	92
PID 2288 wrote to memory of 764	2288	Topaz Video AI.exe	93
PID 2288 wrote to memory of 764	2288	Topaz Video AI.exe	93
PID 2288 wrote to memory of 764	2288	Topaz Video AI.exe	93
PID 764 wrote to memory of 3328	764	Topaz Video AI.exe	94
PID 764 wrote to memory of 3328	764	Topaz Video AI.exe	94
PID 764 wrote to memory of 3328	764	Topaz Video AI.exe	94
PID 3328 wrote to memory of 4856	3328	Topaz Video AI.exe	95
PID 3328 wrote to memory of 4856	3328	Topaz Video AI.exe	95
PID 3328 wrote to memory of 4856	3328	Topaz Video AI.exe	95
PID 3328 wrote to memory of 4856	3328	Topaz Video AI.exe	95
PID 3328 wrote to memory of 4856	3328	Topaz Video AI.exe	95
PID 3328 wrote to memory of 4856	3328	Topaz Video AI.exe	95
PID 3328 wrote to memory of 4856	3328	Topaz Video AI.exe	95
PID 3328 wrote to memory of 4856	3328	Topaz Video AI.exe	95
PID 3328 wrote to memory of 4856	3328	Topaz Video AI.exe	95
PID 3328 wrote to memory of 2404	3328	Topaz Video AI.exe	96
PID 3328 wrote to memory of 2404	3328	Topaz Video AI.exe	96
PID 3328 wrote to memory of 2404	3328	Topaz Video AI.exe	96
PID 3328 wrote to memory of 2404	3328	Topaz Video AI.exe	96
PID 3328 wrote to memory of 2404	3328	Topaz Video AI.exe	96
PID 3328 wrote to memory of 2404	3328	Topaz Video AI.exe	96
PID 3328 wrote to memory of 2404	3328	Topaz Video AI.exe	96

C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
"C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
  "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
    "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
      "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
      4⤵
      PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
      "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
      4⤵
      PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
      "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
      4⤵
      PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
      "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
      4⤵
      PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
      "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:764
    - - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
        5⤵
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
        6⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
        6⤵
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
        6⤵
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
        6⤵
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
        6⤵
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
        6⤵
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
        6⤵
        
        PID:644
      - C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI.exe"
        6⤵
        
        PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1916-6-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/2228-14-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/5052-0-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/5052-2-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/5052-10-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download