raccoon | 8fcc19c0ead093cdeedea2c1ecee99328c672779eae9a9a1507f8e422d56dd07

Analysis

Target
8FCC19C0EAD093CDEEDEA2C1ECEE99328C672779EAE9A.exe
Size 418KB
Sample210509-7194955saa
SHA256 8fcc19c0ead093cdeedea2c1ecee99328c672779eae9a9a1507f8e422d56dd07
MD5 52990366b0f7820347eed51db1a64ea4
SHA1 ab369c861067c351367a3e7fe5d06ebb33d20692
SHA512 48e75694d5f86d0262ba8917a2db07f734fd208c9439c9253ae198faad04520b95483d576189aad3680f4e1d81dce4eace45a203d783521cdbf4ea8465651862
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Attributes

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4016 created 2116	4016	WerFault.exe	43

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4016	2116	WerFault.exe	43

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\8FCC19C0EAD093CDEEDEA2C1ECEE99328C672779EAE9A.exe
"C:\Users\Admin\AppData\Local\Temp\8FCC19C0EAD093CDEEDEA2C1ECEE99328C672779EAE9A.exe"
1⤵
PID:2116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 804
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4016

memory/2116-114-0x00000000009A0000-0x0000000000AEA000-memory.dmp

Download

memory/2116-115-0x0000000000400000-0x0000000000863000-memory.dmp

Download