raccoon | f45b444b6e8d66dc8d97e8ec397a4ffbf1545bef57d783ec906d2c7695b25ac5

Resubmissions

06-10-2021 15:33

04-10-2021 12:00

Target

f45b444b6e8d66dc8d97e8ec397a4ffbf1545bef57d783ec906d2c7695b25ac5.exe
Size

539KB
MD5

39334f7bcc79560e4cba9026fcae6151
SHA1

eb95a578bb947f52bdf0b779b90f605c5a3277d3
SHA256

f45b444b6e8d66dc8d97e8ec397a4ffbf1545bef57d783ec906d2c7695b25ac5
SHA512

c4fc970ec0e46207002cd1785c391fda1b1b6b1eb53ae1179f54df02d172dd75fb4269b00f1586bc164f90a419330b6f3f43fa19a25e64e8722a32db4ce5184e

Score

10^/10

Family

raccoon

Version

1.8.2

Botnet

e672747afc67feb221ca60f8fc9e03adcf10f038

Attributes

url4cnc
http://teletop.top/youyouhell0world

http://teleta.top/youyouhell0world

https://t.me/youyouhell0world

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 8 created 624	8	WerFault.exe	67

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8	624	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\f45b444b6e8d66dc8d97e8ec397a4ffbf1545bef57d783ec906d2c7695b25ac5.exe
"C:\Users\Admin\AppData\Local\Temp\f45b444b6e8d66dc8d97e8ec397a4ffbf1545bef57d783ec906d2c7695b25ac5.exe"
1⤵
PID:624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 640
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:8

memory/624-114-0x0000000000620000-0x00000000006AE000-memory.dmp

Filesize
568KB

Download
memory/624-115-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download