raccoon | 09f6673d04fa445820e1279aa202acde6e33066f2bfb135dd6458fe41398a222

Resubmissions

27-02-2020 14:31

21-02-2020 16:28

20-02-2020 19:36

Target

1157719080.EXE
Size

878KB
MD5

7e70e99390a74ad36bfd7b82f8f6df7e
SHA1

404d5850b8967259d778c796a0720abe35018d98
SHA256

09f6673d04fa445820e1279aa202acde6e33066f2bfb135dd6458fe41398a222
SHA512

c31f71dae0624f30ff1f23640168a769dfb14ff7f8cabf01aa0a3ae4465b1e56f67a12c9bf84b39bb24897ea25ad4144253be2f50ffb640a008e1fcfbaf48226

Score

10^/10

stealer raccoon

Family

raccoon

Botnet

3dbd762906e1b32ddcb1ca61554f89c2f5686d2c

http://34.90.199.36/gate/log.php

Attributes

url4cnc
https://drive.google.com/uc?export=download&id=1-sIY2_CjYF5N7Cc4kIq7R17orSgXQ5Y6

rc4.plain

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

1157719080.EXE

description	pid	process	target process
PID 3840 wrote to memory of 3864	3840	1157719080.EXE	1157719080.EXE
PID 3840 wrote to memory of 3864	3840	1157719080.EXE	1157719080.EXE
PID 3840 wrote to memory of 3864	3840	1157719080.EXE	1157719080.EXE
PID 3840 wrote to memory of 3864	3840	1157719080.EXE	1157719080.EXE
PID 3840 wrote to memory of 3864	3840	1157719080.EXE	1157719080.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

1157719080.EXE

description pid process target process

PID 3840 set thread context of 3864 3840 1157719080.EXE 1157719080.EXE
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

description	pid	process	target process
PID 3840 set thread context of 3864	3840	1157719080.EXE	1157719080.EXE

C:\Users\Admin\AppData\Local\Temp\1157719080.EXE
"C:\Users\Admin\AppData\Local\Temp\1157719080.EXE"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3840
- C:\Users\Admin\AppData\Local\Temp\1157719080.EXE
  "C:\Users\Admin\AppData\Local\Temp\1157719080.EXE"
  2⤵
  PID:3864

memory/3864-0-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/3864-1-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download