raccoon | 13333d8111107cce84e50c0264e4b3ffa7af34802de26de7d229ca86782db674

Analysis

Target
13333D8111107CCE84E50C0264E4B3FFA7AF34802DE26.exe
Size 396KB
Sample210620-5nd48xlc8x
SHA256 13333d8111107cce84e50c0264e4b3ffa7af34802de26de7d229ca86782db674
MD5 01f848f1bea5fee38c9b3ace82d48517
SHA1 bd35c42b99d9c5e4e136505030f3d8f62f33d04f
SHA512 e86e4f88f5ba7d1dcfad9f04b937dbc4c858b4bfdf51f94fe89f4e37d210b23aec40624a5b7c42f9d66d096dc174dcb6d30bae54d06cfe603ff6a837d707786f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Attributes

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1980 created 516	1980	WerFault.exe	67

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1980	516	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\13333D8111107CCE84E50C0264E4B3FFA7AF34802DE26.exe
"C:\Users\Admin\AppData\Local\Temp\13333D8111107CCE84E50C0264E4B3FFA7AF34802DE26.exe"
1⤵
PID:516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 516 -s 1236
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1980

memory/516-114-0x0000000004990000-0x0000000004A21000-memory.dmp

Download

memory/516-115-0x0000000000400000-0x0000000002BD3000-memory.dmp

Download