raccoon | afd8d8d37d356702122236ca272511a8408ec817c33276122641245b034661f6

Resubmissions

21-07-2024 10:07

240721-l5r95azfpn 5

21-07-2024 09:24

240721-lc2m4axelh 10

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 09:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe
Size

813KB
MD5

6a7681530b7cd49a24f0e12f609f0635
SHA1

02595be9615b657bbbbfa4f4296a5f905fb6485a
SHA256

afd8d8d37d356702122236ca272511a8408ec817c33276122641245b034661f6
SHA512

66a3e786f8392fff29f5f6611a89f9b6891da3e12e9fff765d7d1336857c86bdc8674f5f2f70ef73a235a837257ec4bfcf7408d533bbb7a26a9a3ad6c9e1c4f8
SSDEEP

12288:IycLHzILbdesTkxgaEfLDRXrIAzhXUj5/PY88KzRrhK7fVIIa4Nd4K6mZvUoy:BcLHiX1akDR7IcXu/Q8rOfVIp32Uo

Score

10^/10

raccoon 071a7b18a42c1cd94de2fc5bb0bbcaf2 stealer

Malware Config

Extracted

Family

raccoon

Botnet

071a7b18a42c1cd94de2fc5bb0bbcaf2

http://193.142.147.59:80

Attributes

user_agent
Xmlst

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/5328-1099-0x0000000000400000-0x0000000000418000-memory.dmp	family_raccoon_v2
behavioral1/memory/5328-1100-0x0000000000400000-0x0000000000418000-memory.dmp	family_raccoon_v2

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2568 set thread context of 5328	2568	SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe	30

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2568	SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 5328	2568	SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe	30
PID 2568 wrote to memory of 5328	2568	SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe	30
PID 2568 wrote to memory of 5328	2568	SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe	30
PID 2568 wrote to memory of 5328	2568	SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe	30
PID 2568 wrote to memory of 5328	2568	SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe	30
PID 2568 wrote to memory of 5328	2568	SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe	30
PID 2568 wrote to memory of 5328	2568	SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe	30
PID 2568 wrote to memory of 5328	2568	SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe	30
PID 2568 wrote to memory of 5328	2568	SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe	30
PID 2568 wrote to memory of 5328	2568	SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe	30
PID 2568 wrote to memory of 5328	2568	SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe	30
PID 2568 wrote to memory of 5328	2568	SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe	30

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  PID:5328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2568-0-0x000000007463E000-0x000000007463F000-memory.dmp

Filesize
4KB

Download
memory/2568-1-0x0000000000C80000-0x0000000000D52000-memory.dmp

Filesize
840KB

Download
memory/2568-2-0x0000000074630000-0x0000000074D1E000-memory.dmp

Filesize
6.9MB

Download
memory/2568-3-0x0000000004E60000-0x0000000004F1C000-memory.dmp

Filesize
752KB

Download
memory/2568-4-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-5-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-31-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-47-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-57-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-67-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-65-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-63-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-61-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-59-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-55-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-53-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-51-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-49-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-45-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-43-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-41-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-39-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-37-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-35-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-33-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-29-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-27-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-25-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-23-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-21-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-19-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-17-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-15-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-13-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-11-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-9-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-7-0x0000000004E60000-0x0000000004F16000-memory.dmp

Filesize
728KB

Download
memory/2568-1080-0x0000000000B70000-0x0000000000BA6000-memory.dmp

Filesize
216KB

Download
memory/2568-1081-0x00000000042B0000-0x00000000042FC000-memory.dmp

Filesize
304KB

Download
memory/2568-1082-0x0000000074630000-0x0000000074D1E000-memory.dmp

Filesize
6.9MB

Download
memory/2568-1098-0x0000000074630000-0x0000000074D1E000-memory.dmp

Filesize
6.9MB

Download
memory/5328-1099-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/5328-1100-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download