raccoon | b2d75da0ee95724fa0509732685d0da4369dd469828da82d96426ff878fe2f75

Analysis

Target
b2d75da0ee95724fa0509732685d0da4369dd469828da.exe
Size 490KB
Sample211005-syl8vsaae2
SHA256 b2d75da0ee95724fa0509732685d0da4369dd469828da82d96426ff878fe2f75
MD5 d5e9637371ce1a097c2f17ad0813dbb8
SHA1 fde18da1c026bbd2bb2bf41beaa75a2a40ec2190
SHA512 3a1d4126ccbe9a237f41be8281c6e9c0845c75c059ff324a8a0fb9f723032fa0e740301b1d001894090907726699adbe5752b18e1a1edfd4292b1ac85ece0d43
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

Attributes

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1168 created 740	1168	WerFault.exe	67

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1168	740	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\b2d75da0ee95724fa0509732685d0da4369dd469828da.exe
"C:\Users\Admin\AppData\Local\Temp\b2d75da0ee95724fa0509732685d0da4369dd469828da.exe"
1⤵
PID:740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 612
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1168

memory/740-114-0x0000000000960000-0x0000000000AAA000-memory.dmp

Download

memory/740-115-0x0000000000400000-0x00000000008AA000-memory.dmp

Download