raccoon | f45b444b6e8d66dc8d97e8ec397a4ffbf1545bef57d783ec906d2c7695b25ac5

Resubmissions

06-10-2021 15:33

04-10-2021 12:00

Target

f45b444b6e8d66dc8d97e8ec397a4ffbf1545bef57d783ec906d2c7695b25ac5.exe
Size

539KB
MD5

39334f7bcc79560e4cba9026fcae6151
SHA1

eb95a578bb947f52bdf0b779b90f605c5a3277d3
SHA256

f45b444b6e8d66dc8d97e8ec397a4ffbf1545bef57d783ec906d2c7695b25ac5
SHA512

c4fc970ec0e46207002cd1785c391fda1b1b6b1eb53ae1179f54df02d172dd75fb4269b00f1586bc164f90a419330b6f3f43fa19a25e64e8722a32db4ce5184e

Score

10^/10

Family

raccoon

Version

1.8.2

Botnet

e672747afc67feb221ca60f8fc9e03adcf10f038

Attributes

url4cnc
http://teletop.top/youyouhell0world

http://teleta.top/youyouhell0world

https://t.me/youyouhell0world

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	1596	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1696	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1696	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 1696	1596	f45b444b6e8d66dc8d97e8ec397a4ffbf1545bef57d783ec906d2c7695b25ac5.exe	27
PID 1596 wrote to memory of 1696	1596	f45b444b6e8d66dc8d97e8ec397a4ffbf1545bef57d783ec906d2c7695b25ac5.exe	27
PID 1596 wrote to memory of 1696	1596	f45b444b6e8d66dc8d97e8ec397a4ffbf1545bef57d783ec906d2c7695b25ac5.exe	27
PID 1596 wrote to memory of 1696	1596	f45b444b6e8d66dc8d97e8ec397a4ffbf1545bef57d783ec906d2c7695b25ac5.exe	27

C:\Users\Admin\AppData\Local\Temp\f45b444b6e8d66dc8d97e8ec397a4ffbf1545bef57d783ec906d2c7695b25ac5.exe
"C:\Users\Admin\AppData\Local\Temp\f45b444b6e8d66dc8d97e8ec397a4ffbf1545bef57d783ec906d2c7695b25ac5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 440
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1696

memory/1596-53-0x00000000757B1000-0x00000000757B3000-memory.dmp

Filesize
8KB

Download
memory/1596-55-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1596-54-0x00000000004A0000-0x000000000052E000-memory.dmp

Filesize
568KB

Download
memory/1696-57-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download