raccoon | 51173c571dfb12777d7adc8bfd192b741c6989802ea7f5adc8b69d70bcdfd27b

Analysis

max time kernel
152s
max time network
162s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 12:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IDMan.exe
Size

702.2MB
MD5

52c92decb851e99079c17568be886854
SHA1

f2f5dbfbd05a774da037415794e85cc99270148c
SHA256

8b69e17d0ee711d5e5c10118a9c5096997d44fff70d8e1b0dcc7802b181f6e87
SHA512

dd2a084bc974b5d7d8b8692b317c92cbe87aad39e99c8ada2e83c6fde25975faa6fd7bef744a719dd655f3f70fee1b380075872d7cc3c81f823db93d15aa29bd
SSDEEP

49152:MJ8U/HLU3Yp7dPM8V/HLU3Yp7CgUxK3h7/SEyIas8JWsa6HdLK:MJ8U/HQ3r8V/HQ3BbxKxD9jXsj9LK

Score

10^/10

raccoon dd188c0be5001b2c8fb76d74174694cd stealer

Malware Config

Extracted

Family

raccoon

Botnet

dd188c0be5001b2c8fb76d74174694cd

http://147.45.44.25:80/

http://85.28.47.116:80/

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2644-3-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2
behavioral1/memory/2644-4-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2
behavioral1/memory/2644-9-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2
behavioral1/memory/2644-7-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2

Suspicious use of SetThreadContext 5 IoCs

Processes:

IDMan.exeIDMan.exeIDMan.exeIDMan.exe

description	pid	Process	procid_target
PID 3060 set thread context of 2644	3060	IDMan.exe	32
PID 2536 set thread context of 2568	2536	IDMan.exe	35
PID 624 set thread context of 2772	624	IDMan.exe	38
PID 2108 set thread context of 1544	2108	IDMan.exe	46
PID 2108 set thread context of 2120	2108	IDMan.exe	48

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

IDMan.exeIDMan.exeIDMan.exeIDMan.exeIDMan.exeIDMan.exeIDMan.exeIDMan.exeIDMan.exe

description	pid	Process	procid_target
PID 2324 wrote to memory of 3060	2324	IDMan.exe	31
PID 2324 wrote to memory of 3060	2324	IDMan.exe	31
PID 2324 wrote to memory of 3060	2324	IDMan.exe	31
PID 2324 wrote to memory of 3060	2324	IDMan.exe	31
PID 3060 wrote to memory of 2644	3060	IDMan.exe	32
PID 3060 wrote to memory of 2644	3060	IDMan.exe	32
PID 3060 wrote to memory of 2644	3060	IDMan.exe	32
PID 3060 wrote to memory of 2644	3060	IDMan.exe	32
PID 3060 wrote to memory of 2644	3060	IDMan.exe	32
PID 3060 wrote to memory of 2644	3060	IDMan.exe	32
PID 3060 wrote to memory of 2644	3060	IDMan.exe	32
PID 3060 wrote to memory of 2644	3060	IDMan.exe	32
PID 3060 wrote to memory of 2644	3060	IDMan.exe	32
PID 3060 wrote to memory of 2644	3060	IDMan.exe	32
PID 3060 wrote to memory of 2536	3060	IDMan.exe	34
PID 3060 wrote to memory of 2536	3060	IDMan.exe	34
PID 3060 wrote to memory of 2536	3060	IDMan.exe	34
PID 3060 wrote to memory of 2536	3060	IDMan.exe	34
PID 2536 wrote to memory of 2568	2536	IDMan.exe	35
PID 2536 wrote to memory of 2568	2536	IDMan.exe	35
PID 2536 wrote to memory of 2568	2536	IDMan.exe	35
PID 2536 wrote to memory of 2568	2536	IDMan.exe	35
PID 2536 wrote to memory of 2568	2536	IDMan.exe	35
PID 2536 wrote to memory of 2568	2536	IDMan.exe	35
PID 2536 wrote to memory of 2568	2536	IDMan.exe	35
PID 2536 wrote to memory of 2568	2536	IDMan.exe	35
PID 2536 wrote to memory of 2568	2536	IDMan.exe	35
PID 2536 wrote to memory of 2568	2536	IDMan.exe	35
PID 2536 wrote to memory of 1688	2536	IDMan.exe	36
PID 2536 wrote to memory of 1688	2536	IDMan.exe	36
PID 2536 wrote to memory of 1688	2536	IDMan.exe	36
PID 2536 wrote to memory of 1688	2536	IDMan.exe	36
PID 1688 wrote to memory of 624	1688	IDMan.exe	37
PID 1688 wrote to memory of 624	1688	IDMan.exe	37
PID 1688 wrote to memory of 624	1688	IDMan.exe	37
PID 1688 wrote to memory of 624	1688	IDMan.exe	37
PID 624 wrote to memory of 2772	624	IDMan.exe	38
PID 624 wrote to memory of 2772	624	IDMan.exe	38
PID 624 wrote to memory of 2772	624	IDMan.exe	38
PID 624 wrote to memory of 2772	624	IDMan.exe	38
PID 624 wrote to memory of 2772	624	IDMan.exe	38
PID 624 wrote to memory of 2772	624	IDMan.exe	38
PID 624 wrote to memory of 2772	624	IDMan.exe	38
PID 624 wrote to memory of 2772	624	IDMan.exe	38
PID 624 wrote to memory of 2772	624	IDMan.exe	38
PID 624 wrote to memory of 2772	624	IDMan.exe	38
PID 624 wrote to memory of 1632	624	IDMan.exe	40
PID 624 wrote to memory of 1632	624	IDMan.exe	40
PID 624 wrote to memory of 1632	624	IDMan.exe	40
PID 624 wrote to memory of 1632	624	IDMan.exe	40
PID 1632 wrote to memory of 588	1632	IDMan.exe	41
PID 1632 wrote to memory of 588	1632	IDMan.exe	41
PID 1632 wrote to memory of 588	1632	IDMan.exe	41
PID 1632 wrote to memory of 588	1632	IDMan.exe	41
PID 588 wrote to memory of 1172	588	IDMan.exe	42
PID 588 wrote to memory of 1172	588	IDMan.exe	42
PID 588 wrote to memory of 1172	588	IDMan.exe	42
PID 588 wrote to memory of 1172	588	IDMan.exe	42
PID 1172 wrote to memory of 2072	1172	IDMan.exe	43
PID 1172 wrote to memory of 2072	1172	IDMan.exe	43
PID 1172 wrote to memory of 2072	1172	IDMan.exe	43
PID 1172 wrote to memory of 2072	1172	IDMan.exe	43
PID 2072 wrote to memory of 1168	2072	IDMan.exe	44
PID 2072 wrote to memory of 1168	2072	IDMan.exe	44

C:\Users\Admin\AppData\Local\Temp\IDMan.exe
"C:\Users\Admin\AppData\Local\Temp\IDMan.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Admin\AppData\Local\Temp\IDMan.exe
  "C:\Users\Admin\AppData\Local\Temp\IDMan.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Users\Admin\AppData\Local\Temp\IDMan.exe
    "C:\Users\Admin\AppData\Local\Temp\IDMan.exe"
    3⤵
    PID:2644
- - C:\Users\Admin\AppData\Local\Temp\IDMan.exe
    "C:\Users\Admin\AppData\Local\Temp\IDMan.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\IDMan.exe
      "C:\Users\Admin\AppData\Local\Temp\IDMan.exe"
      4⤵
      PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\IDMan.exe
      "C:\Users\Admin\AppData\Local\Temp\IDMan.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\IDMan.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IDMan.exe"
        5⤵
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:624
      - C:\Users\Admin\AppData\Local\Temp\IDMan.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IDMan.exe"
        6⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\IDMan.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IDMan.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\IDMan.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IDMan.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:588
        
        C:\Users\Admin\AppData\Local\Temp\IDMan.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IDMan.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\IDMan.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IDMan.exe"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\IDMan.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IDMan.exe"
        10⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\IDMan.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IDMan.exe"
        11⤵
        Suspicious use of SetThreadContext
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\IDMan.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IDMan.exe"
        12⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\IDMan.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IDMan.exe"
        12⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\IDMan.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IDMan.exe"
        12⤵
        
        PID:2604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2120-57-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2644-1-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/2644-3-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/2644-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2644-4-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/2644-0-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/2644-9-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/2644-10-0x0000000000150000-0x0000000000386000-memory.dmp

Filesize
2.2MB

Download
memory/2644-7-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/2644-2-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download