raccoon | 5f4c117cd7f2a02006da52cd5725d8c2579d2cab1fa8a1dd85faaab47fd04ecb

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23-06-2024 10:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f4c117cd7f2a02006da52cd5725d8c2579d2cab1fa8a1dd85faaab47fd04ecb_NeikiAnalytics.exe
Size

494KB
MD5

1fd4e62013aa31b99b3db397b6db9ce0
SHA1

8d3baf8e1f19bd44903afa2cdb87a4d31fb4a938
SHA256

5f4c117cd7f2a02006da52cd5725d8c2579d2cab1fa8a1dd85faaab47fd04ecb
SHA512

42215bba99a745ae1778b4f6296db0142ce25ea546fc59c8f3820ba00b486e26b2308819e4e44d994aad1dd42a975d6b75ed1cbbbc7e21c1e01df5a7cd5d2ae5
SSDEEP

12288:IrFu5n+lFTv5qVxivxwJrsdbvutQdaEsBu:I45n2v8VxGwJkbvutLEsBu

Score

10^/10

raccoon 5d224fd6c26c50ca4fea125e43d52eff1b8373e6 stealer

Malware Config

Extracted

Family

raccoon

Botnet

5d224fd6c26c50ca4fea125e43d52eff1b8373e6

Attributes

url4cnc
https://drive.google.com/uc?export=download&id=1qOwjltN62v2z1O2ar8qbu8ru2QwxaRnr

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1636-2-0x00000000002E0000-0x000000000036E000-memory.dmp	family_raccoon_v1
behavioral1/memory/1636-3-0x0000000000400000-0x0000000000490000-memory.dmp	family_raccoon_v1
behavioral1/memory/1636-4-0x0000000000400000-0x000000000052A000-memory.dmp	family_raccoon_v1
behavioral1/memory/1636-7-0x00000000002E0000-0x000000000036E000-memory.dmp	family_raccoon_v1
behavioral1/memory/1636-8-0x0000000000400000-0x0000000000490000-memory.dmp	family_raccoon_v1

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

2 drive.google.com
3 drive.google.com
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2464 1636 WerFault.exe 5f4c117cd7f2a02006da52cd5725d8c2579d2cab1fa8a1dd85faaab47fd04ecb_NeikiAnalytics.exe

flow	ioc
2	drive.google.com
3	drive.google.com

pid	pid_target	process	target process
2464	1636	WerFault.exe	5f4c117cd7f2a02006da52cd5725d8c2579d2cab1fa8a1dd85faaab47fd04ecb_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5f4c117cd7f2a02006da52cd5725d8c2579d2cab1fa8a1dd85faaab47fd04ecb_NeikiAnalytics.exe

description	pid	process	target process
PID 1636 wrote to memory of 2464	1636	5f4c117cd7f2a02006da52cd5725d8c2579d2cab1fa8a1dd85faaab47fd04ecb_NeikiAnalytics.exe	WerFault.exe
PID 1636 wrote to memory of 2464	1636	5f4c117cd7f2a02006da52cd5725d8c2579d2cab1fa8a1dd85faaab47fd04ecb_NeikiAnalytics.exe	WerFault.exe
PID 1636 wrote to memory of 2464	1636	5f4c117cd7f2a02006da52cd5725d8c2579d2cab1fa8a1dd85faaab47fd04ecb_NeikiAnalytics.exe	WerFault.exe
PID 1636 wrote to memory of 2464	1636	5f4c117cd7f2a02006da52cd5725d8c2579d2cab1fa8a1dd85faaab47fd04ecb_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5f4c117cd7f2a02006da52cd5725d8c2579d2cab1fa8a1dd85faaab47fd04ecb_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5f4c117cd7f2a02006da52cd5725d8c2579d2cab1fa8a1dd85faaab47fd04ecb_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 908
2⤵
- Program crash
PID:2464

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1636-1-0x00000000005E0000-0x00000000006E0000-memory.dmp

Filesize
1024KB

Download
memory/1636-2-0x00000000002E0000-0x000000000036E000-memory.dmp

Filesize
568KB

Download
memory/1636-3-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1636-4-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/1636-6-0x00000000005E0000-0x00000000006E0000-memory.dmp

Filesize
1024KB

Download
memory/1636-7-0x00000000002E0000-0x000000000036E000-memory.dmp

Filesize
568KB

Download
memory/1636-8-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download