Overview

overview

10

Static

static

3

04c1ecaed9...18.exe

windows7-x64

10

04c1ecaed9...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-10-2024 16:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe

  • Size

    168KB

  • MD5

    6643c64f29617b4e7cae474dc454431d

  • SHA1

    04c1ecaed917232ef3c8dfb885e8dda84d781d18

  • SHA256

    5dce0479f4adabaadf0faad5bf1478bb225787f3e1a7fc8d03495e0aed13b843

  • SHA512

    5c73d4a9567525679dcb64eb18134c61cc0f35572af711ba11e2abcbd4ff1bf987d3234057dbfb41796addcd07e87b425af21a6c6c52c692b4786936f85c39c8

  • SSDEEP

    3072:0Rb8x8w8spF105inBx3mTvld6Cge4Nkz7RSx/iQ46oE6Tv:0Z8Ow8GFC5W3mTvWChzlS41R

Score
10/10
raccoon970bd7b21ef58eba844bcc1b35da559adiscoveryspywarestealer

Malware Config

Extracted

Family

raccoon

Botnet

970bd7b21ef58eba844bcc1b35da559a

C2

http://193.187.174.250:80/

http://176.113.115.103:80/
Attributes
  • user_agent

    MrBidenNeverKnow

xor.plain

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon
  • Raccoon Stealer V2 payload 4 IoCs
  • Raccoon family
    raccoon
  • Downloads MZ/PE file
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe
    "C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:880
    • C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe
      "C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4360
    • C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe
      "C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe"
      2⤵
        PID:1716
      • C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe
        "C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe"
        2⤵
          PID:4224
        • C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe
          "C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1232
          • C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe
            "C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe"
            3⤵
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2896
            • C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe
              "C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe"
              4⤵
                PID:2692
              • C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe
                "C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe"
                4⤵
                  PID:2768
                • C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe
                  "C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe"
                  4⤵
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1816
                  • C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe
                    "C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe"
                    5⤵
                      PID:5088
                    • C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe
                      "C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe"
                      5⤵
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:1860
                      • C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe
                        "C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe"
                        6⤵
                          PID:4676
                        • C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe
                          "C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe"
                          6⤵
                            PID:1872
                          • C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe
                            "C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe"
                            6⤵
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            PID:4128
                            • C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe
                              "C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe"
                              7⤵
                                PID:2780
                              • C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe
                                "C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe"
                                7⤵
                                  PID:2108
                                • C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe
                                  "C:\Users\Admin\AppData\Local\Temp\04c1ecaed917232ef3c8dfb885e8dda84d781d18.exe"
                                  7⤵
                                    PID:3528

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\LocalLow\6zfHWXti5L19
                        Filesize

                        114KB

                        MD5

                        9a3be5cb8635e4df5189c9aaa9c1b3c0

                        SHA1

                        9a7ce80c8b4362b7c10294bb1551a6172e656f47

                        SHA256

                        958f70959a70caf02c0063fe80f12c4d4d3f822a9fd640a6685c345d98708c26

                        SHA512

                        5c538513eba7ebaf7028b924d992b4c32ca323ad44f7a31e21970ed6852ea8b54cf71b2f811e8bf97f2744ee151e001ea52ba43b61cd032cc5a4c886292aac65

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\Nf94S4Pp2wDd
                        Filesize

                        116KB

                        MD5

                        f70aa3fa04f0536280f872ad17973c3d

                        SHA1

                        50a7b889329a92de1b272d0ecf5fce87395d3123

                        SHA256

                        8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                        SHA512

                        30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\mozglue.dll
                        Filesize

                        612KB

                        MD5

                        f07d9977430e762b563eaadc2b94bbfa

                        SHA1

                        da0a05b2b8d269fb73558dfcf0ed5c167f6d3877

                        SHA256

                        4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862

                        SHA512

                        6afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\nss3.dll
                        Filesize

                        1.9MB

                        MD5

                        f67d08e8c02574cbc2f1122c53bfb976

                        SHA1

                        6522992957e7e4d074947cad63189f308a80fcf2

                        SHA256

                        c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e

                        SHA512

                        2e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\sqlite3.dll
                        Filesize

                        1.0MB

                        MD5

                        dbf4f8dcefb8056dc6bae4b67ff810ce

                        SHA1

                        bbac1dd8a07c6069415c04b62747d794736d0689

                        SHA256

                        47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68

                        SHA512

                        b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1

                        Download Submit

                      • memory/1716-12-0x0000000000400000-0x0000000000416000-memory.dmp

                        Filesize

                        88KB

                        Download

                      • memory/4360-0-0x0000000000400000-0x0000000000416000-memory.dmp

                        Filesize

                        88KB

                        Download

                      • memory/4360-2-0x0000000000400000-0x0000000000416000-memory.dmp

                        Filesize

                        88KB

                        Download

                      • memory/4360-46-0x0000000000400000-0x0000000000416000-memory.dmp

                        Filesize

                        88KB

                        Download

                      • memory/4360-58-0x0000000061E00000-0x0000000061EF1000-memory.dmp

                        Filesize

                        964KB

                        Download