raccoon | 8fcc19c0ead093cdeedea2c1ecee99328c672779eae9a9a1507f8e422d56dd07

Analysis

Target

8FCC19C0EAD093CDEEDEA2C1ECEE99328C672779EAE9A.exe
Size

418KB
MD5

52990366b0f7820347eed51db1a64ea4
SHA1

ab369c861067c351367a3e7fe5d06ebb33d20692
SHA256

8fcc19c0ead093cdeedea2c1ecee99328c672779eae9a9a1507f8e422d56dd07
SHA512

48e75694d5f86d0262ba8917a2db07f734fd208c9439c9253ae198faad04520b95483d576189aad3680f4e1d81dce4eace45a203d783521cdbf4ea8465651862

Score

10^/10

Family

raccoon

Botnet

a3a85b69314053c3bb015532d1a960a3d08baeb8

Attributes

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 960 created 784 960 WerFault.exe 8FCC19C0EAD093CDEEDEA2C1ECEE99328C672779EAE9A.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

960 784 WerFault.exe 8FCC19C0EAD093CDEEDEA2C1ECEE99328C672779EAE9A.exe

description	pid	process	target process
PID 960 created 784	960	WerFault.exe	8FCC19C0EAD093CDEEDEA2C1ECEE99328C672779EAE9A.exe

pid	pid_target	process	target process
960	784	WerFault.exe	8FCC19C0EAD093CDEEDEA2C1ECEE99328C672779EAE9A.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 960 WerFault.exe
Token: SeBackupPrivilege 960 WerFault.exe
Token: SeDebugPrivilege 960 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8FCC19C0EAD093CDEEDEA2C1ECEE99328C672779EAE9A.exe
"C:\Users\Admin\AppData\Local\Temp\8FCC19C0EAD093CDEEDEA2C1ECEE99328C672779EAE9A.exe"
1⤵
PID:784

memory/784-114-0x0000000000DE0000-0x0000000000E72000-memory.dmp

Filesize
584KB

Download
memory/784-115-0x0000000000400000-0x0000000000863000-memory.dmp

Filesize
4.4MB

Download