Analysis
- max time kernel
96s - max time network
112s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
02/09/2024, 14:54
General
- Target d3a88ab037be1a370dc7e5e637755df0N.exe
- Size 596KB
- Sample240902-r911qatdqa
- SHA256 ae5f4ca290fade383b6236a1c025027c4fc1247242a13e12f12e7f6be67f63a3
Malware Config
Extracted
-
raccoon
-
51b6734addd400a71cf82ae03c984c90
-
http://116.203.232.114:80/
-
user_agent
MrBidenNeverKnow
Signatures
- Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
- Raccoon Stealer V2 payload 2 IoCs
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3a88ab037be1a370dc7e5e637755df0N.exe"C:\Users\Admin\AppData\Local\Temp\d3a88ab037be1a370dc7e5e637755df0N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1900-62-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/1900-1-0x00000000002A0000-0x000000000033C000-memory.dmp
memory/1900-2-0x0000000005BA0000-0x0000000006144000-memory.dmp
memory/1900-3-0x0000000005690000-0x0000000005722000-memory.dmp
memory/1900-4-0x0000000005730000-0x00000000057CC000-memory.dmp
memory/1900-5-0x0000000005670000-0x000000000567A000-memory.dmp
memory/1900-6-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/1900-7-0x0000000009020000-0x00000000092E2000-memory.dmp
memory/1900-8-0x0000000002F20000-0x0000000002F26000-memory.dmp
memory/1900-9-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/1900-10-0x0000000008D70000-0x0000000008D8A000-memory.dmp
memory/1900-11-0x0000000007320000-0x0000000007326000-memory.dmp
memory/1900-12-0x000000007529E000-0x000000007529F000-memory.dmp
memory/1900-13-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/1900-14-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/1900-0-0x000000007529E000-0x000000007529F000-memory.dmp
memory/2544-15-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/2544-34-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/2544-18-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/2544-26-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/2544-24-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/2544-40-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/2544-16-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/2544-44-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/2544-22-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/2544-42-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/2544-20-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/2544-55-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/2544-56-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/2544-57-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/2544-58-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/2544-17-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/2544-65-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/3624-59-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3624-60-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4324-63-0x0000000000400000-0x000000000045C000-memory.dmp
memory/4324-66-0x0000000008820000-0x0000000008E38000-memory.dmp
memory/4324-67-0x0000000008390000-0x000000000849A000-memory.dmp
memory/4324-68-0x00000000082D0000-0x00000000082E2000-memory.dmp
memory/4324-69-0x0000000008330000-0x000000000836C000-memory.dmp
memory/4324-70-0x00000000084A0000-0x00000000084EC000-memory.dmp
memory/4324-71-0x00000000090B0000-0x0000000009116000-memory.dmp
memory/4324-72-0x00000000093A0000-0x0000000009416000-memory.dmp
memory/4324-73-0x0000000009350000-0x000000000936E000-memory.dmp
memory/4324-74-0x0000000009C80000-0x0000000009E42000-memory.dmp
memory/4324-75-0x000000000A380000-0x000000000A8AC000-memory.dmp