raccoon | 7dca5264c8f0417686482b9f17571a60ac0e399180340deca165fe7fe2a9eb81

Analysis

Target

bfbc5c7fdfdaf8147dbf6d1e4ea3e4f0.exe
Size

548KB
MD5

bfbc5c7fdfdaf8147dbf6d1e4ea3e4f0
SHA1

318923e7cb849bee7f09fe18ea79e506311fb100
SHA256

7dca5264c8f0417686482b9f17571a60ac0e399180340deca165fe7fe2a9eb81
SHA512

24a9d67c7760fc867368be65b8a607f4ff364941d820f5cae38ec06aff1ccb299449e18ac70335bf7bd732ce92f80d752f3c6cc695073c8b0ade3e8017b8e2c6

Score

10^/10

Family

raccoon

Botnet

21caed469b59526d75348692eec1d8ae289ec69c

Attributes

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3600 created 4012 3600 WerFault.exe bfbc5c7fdfdaf8147dbf6d1e4ea3e4f0.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3600 4012 WerFault.exe bfbc5c7fdfdaf8147dbf6d1e4ea3e4f0.exe

description	pid	process	target process
PID 3600 created 4012	3600	WerFault.exe	bfbc5c7fdfdaf8147dbf6d1e4ea3e4f0.exe

pid	pid_target	process	target process
3600	4012	WerFault.exe	bfbc5c7fdfdaf8147dbf6d1e4ea3e4f0.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3600 WerFault.exe
Token: SeBackupPrivilege 3600 WerFault.exe
Token: SeDebugPrivilege 3600 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bfbc5c7fdfdaf8147dbf6d1e4ea3e4f0.exe
"C:\Users\Admin\AppData\Local\Temp\bfbc5c7fdfdaf8147dbf6d1e4ea3e4f0.exe"
1⤵
PID:4012

memory/3600-6-0x0000000004070000-0x0000000004071000-memory.dmp

Filesize
4KB

Download
memory/3600-7-0x0000000004070000-0x0000000004071000-memory.dmp

Filesize
4KB

Download
memory/4012-2-0x00000000041D0000-0x00000000041D1000-memory.dmp

Filesize
4KB

Download
memory/4012-3-0x00000000041D0000-0x0000000004261000-memory.dmp

Filesize
580KB

Download
memory/4012-5-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4012-4-0x0000000004020000-0x00000000040B2000-memory.dmp

Filesize
584KB

Download