raccoon | af3a3e08e6aac8a4438f6a0453042ef57148887d1c74751a77a5bbef6d5e87de

Analysis

Target
f30a4dd80754827952e98733bc2ca29f.exe
Size 490KB
Sample211005-tkmsxaaag5
SHA256 af3a3e08e6aac8a4438f6a0453042ef57148887d1c74751a77a5bbef6d5e87de
MD5 f30a4dd80754827952e98733bc2ca29f
SHA1 d43dc7d6647609a7fa0a1ca55cc8f2013e6a0643
SHA512 77f0ff2ffac09ad3938b6f3a8180b36814ddabf8e7d396decade3578cf47bb725314a32a9015a6c175efcf1beb4c9f284b61f1f17946289a5b95d5e2d8754634
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

Attributes

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3816 created 1832	3816	WerFault.exe	67

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3816	1832	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\f30a4dd80754827952e98733bc2ca29f.exe
"C:\Users\Admin\AppData\Local\Temp\f30a4dd80754827952e98733bc2ca29f.exe"
1⤵
PID:1832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1156
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3816

memory/1832-114-0x0000000000E40000-0x0000000000ED0000-memory.dmp

Download

memory/1832-115-0x0000000000400000-0x00000000008AA000-memory.dmp

Download