Analysis
- max time kernel
143s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
09/08/2024, 19:07
General
- Target 974bc77cb81fc01f84907370cc3ef55c9e243c6e0e1df7b3af8238dc1bd68fd5.exe
- Size 1.9MB
- Sample240809-xsrnlsvbln
- SHA256 974bc77cb81fc01f84907370cc3ef55c9e243c6e0e1df7b3af8238dc1bd68fd5
Malware Config
Extracted
-
raccoon
-
cdfc9a1f925b0d382ad5704a3cb352fb
-
http://192.121.23.67:80/
-
user_agent
MrBidenNeverKnow
Signatures
- Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
- Raccoon Stealer V2 payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\974bc77cb81fc01f84907370cc3ef55c9e243c6e0e1df7b3af8238dc1bd68fd5.exe"C:\Users\Admin\AppData\Local\Temp\974bc77cb81fc01f84907370cc3ef55c9e243c6e0e1df7b3af8238dc1bd68fd5.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2028-4896-0x0000000000400000-0x0000000000416000-memory.dmp
memory/2028-4898-0x0000000000400000-0x0000000000416000-memory.dmp
memory/2244-0-0x000000007496E000-0x000000007496F000-memory.dmp
memory/2244-1-0x0000000000C10000-0x0000000000DF6000-memory.dmp
memory/2244-2-0x0000000074960000-0x0000000075110000-memory.dmp
memory/2244-3-0x0000000074960000-0x0000000075110000-memory.dmp
memory/2244-19-0x0000000008110000-0x0000000008332000-memory.dmp
memory/2244-20-0x0000000074960000-0x0000000075110000-memory.dmp
memory/2244-28-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-30-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-47-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-45-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-43-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-41-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-39-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-37-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-35-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-32-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-33-0x0000000074960000-0x0000000075110000-memory.dmp
memory/2244-26-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-24-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-21-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-22-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-56-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-53-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-51-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-57-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-61-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-69-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-67-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-83-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-81-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-85-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-79-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-77-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-75-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-73-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-71-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-65-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-63-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-59-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-49-0x0000000008110000-0x000000000832D000-memory.dmp
memory/2244-4884-0x000000007496E000-0x000000007496F000-memory.dmp
memory/2244-4887-0x0000000074960000-0x0000000075110000-memory.dmp
memory/2244-4886-0x0000000074960000-0x0000000075110000-memory.dmp
memory/2244-4885-0x0000000074960000-0x0000000075110000-memory.dmp
memory/2244-4889-0x0000000005F40000-0x0000000005F8C000-memory.dmp
memory/2244-4888-0x0000000005E70000-0x0000000005ED0000-memory.dmp
memory/2244-4890-0x0000000008A10000-0x0000000008FB4000-memory.dmp
memory/2244-4891-0x0000000006DC0000-0x0000000006E14000-memory.dmp
memory/2244-4897-0x0000000074960000-0x0000000075110000-memory.dmp