raccoon | b5e3ebba289b7a666d91af6ca9e80d973ae0aecc14f12df0657490d910df166d

Analysis

Target
B5E3EBBA289B7A666D91AF6CA9E80D973AE0AECC14F12.exe
Size 612KB
Sample210722-1kblpse586
SHA256 b5e3ebba289b7a666d91af6ca9e80d973ae0aecc14f12df0657490d910df166d
MD5 c9fc03ae8ccf60677cfedfa93fb41cf6
SHA1 d63d3c03373f7a523a23f1b131bcc66d11ce49f2
SHA512 97f718d7598d5f38ac3627005ea327e384a8dffa1eff741f90598d4955dbb105e50a87a727e466387869b35699deb359ff749a85e25e6b373186a8c48c22bb06
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Attributes

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1332 created 3492	1332	WerFault.exe	41

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1332	3492	WerFault.exe	41

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\B5E3EBBA289B7A666D91AF6CA9E80D973AE0AECC14F12.exe
"C:\Users\Admin\AppData\Local\Temp\B5E3EBBA289B7A666D91AF6CA9E80D973AE0AECC14F12.exe"
1⤵
PID:3492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 1044
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1332

memory/3492-114-0x00000000022B0000-0x0000000002341000-memory.dmp

Download

memory/3492-115-0x0000000000400000-0x00000000004AE000-memory.dmp

Download