raccoon | 1307ef8cd27ad79e39220c23728f2f5dcc52ab9a542e407795c193063ef0fc8c

Analysis

max time kernel
152s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Patch.exe
Size

702.2MB
MD5

52c92decb851e99079c17568be886854
SHA1

f2f5dbfbd05a774da037415794e85cc99270148c
SHA256

8b69e17d0ee711d5e5c10118a9c5096997d44fff70d8e1b0dcc7802b181f6e87
SHA512

dd2a084bc974b5d7d8b8692b317c92cbe87aad39e99c8ada2e83c6fde25975faa6fd7bef744a719dd655f3f70fee1b380075872d7cc3c81f823db93d15aa29bd
SSDEEP

49152:MJ8U/HLU3Yp7dPM8V/HLU3Yp7CgUxK3h7/SEyIas8JWsa6HdLK:MJ8U/HQ3r8V/HQ3BbxKxD9jXsj9LK

Score

10^/10

raccoon dd188c0be5001b2c8fb76d74174694cd stealer

Malware Config

Extracted

Family

raccoon

Botnet

dd188c0be5001b2c8fb76d74174694cd

http://147.45.44.25:80/

http://85.28.47.116:80/

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 5 IoCs

resource	yara_rule
behavioral2/memory/3080-0-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2
behavioral2/memory/3080-2-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2
behavioral2/memory/1552-6-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2
behavioral2/memory/3080-10-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2
behavioral2/memory/3856-18-0x0000000000400000-0x00000000004D0000-memory.dmp	family_raccoon_v2

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 800 set thread context of 3080	800	Patch.exe	84
PID 800 set thread context of 1552	800	Patch.exe	85
PID 800 set thread context of 1180	800	Patch.exe	88
PID 800 set thread context of 3856	800	Patch.exe	90
PID 800 set thread context of 1844	800	Patch.exe	91
PID 800 set thread context of 3108	800	Patch.exe	92
PID 3852 set thread context of 3944	3852	Patch.exe	95
PID 3852 set thread context of 4208	3852	Patch.exe	96
PID 1556 set thread context of 1044	1556	Patch.exe	98
PID 3432 set thread context of 1548	3432	Patch.exe	101
PID 3432 set thread context of 4280	3432	Patch.exe	102

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 3080	800	Patch.exe	84
PID 800 wrote to memory of 3080	800	Patch.exe	84
PID 800 wrote to memory of 3080	800	Patch.exe	84
PID 800 wrote to memory of 3080	800	Patch.exe	84
PID 800 wrote to memory of 3080	800	Patch.exe	84
PID 800 wrote to memory of 3080	800	Patch.exe	84
PID 800 wrote to memory of 3080	800	Patch.exe	84
PID 800 wrote to memory of 3080	800	Patch.exe	84
PID 800 wrote to memory of 3080	800	Patch.exe	84
PID 800 wrote to memory of 1552	800	Patch.exe	85
PID 800 wrote to memory of 1552	800	Patch.exe	85
PID 800 wrote to memory of 1552	800	Patch.exe	85
PID 800 wrote to memory of 1552	800	Patch.exe	85
PID 800 wrote to memory of 1552	800	Patch.exe	85
PID 800 wrote to memory of 1552	800	Patch.exe	85
PID 800 wrote to memory of 1552	800	Patch.exe	85
PID 800 wrote to memory of 1552	800	Patch.exe	85
PID 800 wrote to memory of 1552	800	Patch.exe	85
PID 800 wrote to memory of 1180	800	Patch.exe	88
PID 800 wrote to memory of 1180	800	Patch.exe	88
PID 800 wrote to memory of 1180	800	Patch.exe	88
PID 800 wrote to memory of 1180	800	Patch.exe	88
PID 800 wrote to memory of 1180	800	Patch.exe	88
PID 800 wrote to memory of 1180	800	Patch.exe	88
PID 800 wrote to memory of 1180	800	Patch.exe	88
PID 800 wrote to memory of 1180	800	Patch.exe	88
PID 800 wrote to memory of 1180	800	Patch.exe	88
PID 800 wrote to memory of 3856	800	Patch.exe	90
PID 800 wrote to memory of 3856	800	Patch.exe	90
PID 800 wrote to memory of 3856	800	Patch.exe	90
PID 800 wrote to memory of 3856	800	Patch.exe	90
PID 800 wrote to memory of 3856	800	Patch.exe	90
PID 800 wrote to memory of 3856	800	Patch.exe	90
PID 800 wrote to memory of 3856	800	Patch.exe	90
PID 800 wrote to memory of 3856	800	Patch.exe	90
PID 800 wrote to memory of 3856	800	Patch.exe	90
PID 800 wrote to memory of 1844	800	Patch.exe	91
PID 800 wrote to memory of 1844	800	Patch.exe	91
PID 800 wrote to memory of 1844	800	Patch.exe	91
PID 800 wrote to memory of 1844	800	Patch.exe	91
PID 800 wrote to memory of 1844	800	Patch.exe	91
PID 800 wrote to memory of 1844	800	Patch.exe	91
PID 800 wrote to memory of 1844	800	Patch.exe	91
PID 800 wrote to memory of 1844	800	Patch.exe	91
PID 800 wrote to memory of 1844	800	Patch.exe	91
PID 800 wrote to memory of 3108	800	Patch.exe	92
PID 800 wrote to memory of 3108	800	Patch.exe	92
PID 800 wrote to memory of 3108	800	Patch.exe	92
PID 800 wrote to memory of 3108	800	Patch.exe	92
PID 800 wrote to memory of 3108	800	Patch.exe	92
PID 800 wrote to memory of 3108	800	Patch.exe	92
PID 800 wrote to memory of 3108	800	Patch.exe	92
PID 800 wrote to memory of 3108	800	Patch.exe	92
PID 800 wrote to memory of 3108	800	Patch.exe	92
PID 800 wrote to memory of 3528	800	Patch.exe	93
PID 800 wrote to memory of 3528	800	Patch.exe	93
PID 800 wrote to memory of 3528	800	Patch.exe	93
PID 3528 wrote to memory of 3852	3528	Patch.exe	94
PID 3528 wrote to memory of 3852	3528	Patch.exe	94
PID 3528 wrote to memory of 3852	3528	Patch.exe	94
PID 3852 wrote to memory of 3944	3852	Patch.exe	95
PID 3852 wrote to memory of 3944	3852	Patch.exe	95
PID 3852 wrote to memory of 3944	3852	Patch.exe	95
PID 3852 wrote to memory of 3944	3852	Patch.exe	95

C:\Users\Admin\AppData\Local\Temp\Patch.exe
"C:\Users\Admin\AppData\Local\Temp\Patch.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:800
- C:\Users\Admin\AppData\Local\Temp\Patch.exe
  "C:\Users\Admin\AppData\Local\Temp\Patch.exe"
  2⤵
  PID:3080
- C:\Users\Admin\AppData\Local\Temp\Patch.exe
  "C:\Users\Admin\AppData\Local\Temp\Patch.exe"
  2⤵
  PID:1552
- C:\Users\Admin\AppData\Local\Temp\Patch.exe
  "C:\Users\Admin\AppData\Local\Temp\Patch.exe"
  2⤵
  PID:1180
- C:\Users\Admin\AppData\Local\Temp\Patch.exe
  "C:\Users\Admin\AppData\Local\Temp\Patch.exe"
  2⤵
  PID:3856
- C:\Users\Admin\AppData\Local\Temp\Patch.exe
  "C:\Users\Admin\AppData\Local\Temp\Patch.exe"
  2⤵
  PID:1844
- C:\Users\Admin\AppData\Local\Temp\Patch.exe
  "C:\Users\Admin\AppData\Local\Temp\Patch.exe"
  2⤵
  PID:3108
- C:\Users\Admin\AppData\Local\Temp\Patch.exe
  "C:\Users\Admin\AppData\Local\Temp\Patch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Users\Admin\AppData\Local\Temp\Patch.exe
    "C:\Users\Admin\AppData\Local\Temp\Patch.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3852
  - - C:\Users\Admin\AppData\Local\Temp\Patch.exe
      "C:\Users\Admin\AppData\Local\Temp\Patch.exe"
      4⤵
      PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\Patch.exe
      "C:\Users\Admin\AppData\Local\Temp\Patch.exe"
      4⤵
      PID:4208
  - - C:\Users\Admin\AppData\Local\Temp\Patch.exe
      "C:\Users\Admin\AppData\Local\Temp\Patch.exe"
      4⤵
      Suspicious use of SetThreadContext
      PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Patch.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Patch.exe"
        5⤵
        
        PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\Patch.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Patch.exe"
        5⤵
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Patch.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Patch.exe"
        6⤵
        Suspicious use of SetThreadContext
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Patch.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Patch.exe"
        7⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Patch.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Patch.exe"
        7⤵
        
        PID:4280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1552-6-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/3080-0-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/3080-2-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/3080-10-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/3856-18-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download