Analysis

  • max time kernel
    145s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-11-2024 20:34

General

  • Target

    REVISED ISF Simple Data Template - .TAIPEI PORT.scr

  • Size

    939KB

  • MD5

    8f2339ea03c28445e8953c962b627a9f

  • SHA1

    78bb830baac34639d32490699ff1538417c253fa

  • SHA256

    223190694e03de0b3c9c95bdf8aeede128541033d3cf7bd4abeda4c17bba3d96

  • SHA512

    7956bf31099d792a8a307ae721c1bd1e72892c639371850e2e67f85efa024b9278442445979324f916ff4f583320bd58ca89fe917a1c7685c48d39b1ef5fbe1a

  • SSDEEP

    24576:HKQT/RPn1mpm2GmwzjZkY8HexKBwi/hMNFDWpke:zj51mdGRjZ0jhMNFqke

Malware Config

Extracted

Family

raccoon

Version

1.8.2

Botnet

a41ffcd20150e4814320ae5f467659001fd5a10f

Attributes
  • url4cnc

    http://teletop.top/h_awp_1

    http://teleta.top/h_awp_1

    https://t.me/h_awp_1

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • Raccoon Stealer V1 payload 6 IoCs
  • Raccoon family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\REVISED ISF Simple Data Template - .TAIPEI PORT.scr
    "C:\Users\Admin\AppData\Local\Temp\REVISED ISF Simple Data Template - .TAIPEI PORT.scr" /S
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1820
    • C:\Users\Admin\AppData\Local\Temp\REVISED ISF Simple Data Template - .TAIPEI PORT.scr
      "C:\Users\Admin\AppData\Local\Temp\REVISED ISF Simple Data Template - .TAIPEI PORT.scr"
      2⤵
        PID:4000
      • C:\Users\Admin\AppData\Local\Temp\REVISED ISF Simple Data Template - .TAIPEI PORT.scr
        "C:\Users\Admin\AppData\Local\Temp\REVISED ISF Simple Data Template - .TAIPEI PORT.scr"
        2⤵
          PID:4620
        • C:\Users\Admin\AppData\Local\Temp\REVISED ISF Simple Data Template - .TAIPEI PORT.scr
          "C:\Users\Admin\AppData\Local\Temp\REVISED ISF Simple Data Template - .TAIPEI PORT.scr"
          2⤵
            PID:2280
          • C:\Users\Admin\AppData\Local\Temp\REVISED ISF Simple Data Template - .TAIPEI PORT.scr
            "C:\Users\Admin\AppData\Local\Temp\REVISED ISF Simple Data Template - .TAIPEI PORT.scr"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:3280

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1820-8-0x0000000074CB0000-0x0000000075460000-memory.dmp

          Filesize

          7.7MB

        • memory/1820-2-0x0000000005380000-0x0000000005924000-memory.dmp

          Filesize

          5.6MB

        • memory/1820-9-0x0000000007810000-0x00000000078AC000-memory.dmp

          Filesize

          624KB

        • memory/1820-10-0x0000000007A20000-0x0000000007AD8000-memory.dmp

          Filesize

          736KB

        • memory/1820-4-0x0000000004E50000-0x0000000004E5A000-memory.dmp

          Filesize

          40KB

        • memory/1820-5-0x0000000074CB0000-0x0000000075460000-memory.dmp

          Filesize

          7.7MB

        • memory/1820-6-0x0000000006140000-0x000000000614C000-memory.dmp

          Filesize

          48KB

        • memory/1820-7-0x0000000074CBE000-0x0000000074CBF000-memory.dmp

          Filesize

          4KB

        • memory/1820-0-0x0000000074CBE000-0x0000000074CBF000-memory.dmp

          Filesize

          4KB

        • memory/1820-1-0x0000000000330000-0x0000000000422000-memory.dmp

          Filesize

          968KB

        • memory/1820-3-0x0000000004E70000-0x0000000004F02000-memory.dmp

          Filesize

          584KB

        • memory/1820-11-0x0000000007AD0000-0x0000000007B61000-memory.dmp

          Filesize

          580KB

        • memory/1820-17-0x0000000074CB0000-0x0000000075460000-memory.dmp

          Filesize

          7.7MB

        • memory/3280-15-0x0000000000400000-0x0000000000491000-memory.dmp

          Filesize

          580KB

        • memory/3280-13-0x0000000000400000-0x0000000000491000-memory.dmp

          Filesize

          580KB

        • memory/3280-16-0x0000000000400000-0x0000000000491000-memory.dmp

          Filesize

          580KB

        • memory/3280-12-0x0000000000400000-0x0000000000491000-memory.dmp

          Filesize

          580KB

        • memory/3280-18-0x0000000000400000-0x0000000000491000-memory.dmp

          Filesize

          580KB