raccoon | b9edb0ccfa91cbc5f3d0586ccffdb460633b259e623c5f796311fe5675e9b70e

Analysis

Target
e8ea3fd7c6aa3c9fe156bae1ed89d588.exe
Size 484KB
Sample211007-lrmsgscdgn
SHA256 b9edb0ccfa91cbc5f3d0586ccffdb460633b259e623c5f796311fe5675e9b70e
MD5 e8ea3fd7c6aa3c9fe156bae1ed89d588
SHA1 20bc43bd604db99464e9488b8e924f981e88a18b
SHA512 c7b9cc55932a7552c9ab4fb1d4599e2cfd8a15187085ec078187dc3cb735e30e53bb7471dcab7e3fe80faf211b00b3590ab54c8d23563e683a2397e313e65bf4
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

Attributes

url4cnc
http://teletop.top/agrybirdsgamerept

http://teleta.top/agrybirdsgamerept

https://t.me/agrybirdsgamerept

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4724 created 4648	4724	WerFault.exe	67

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4724	4648	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\e8ea3fd7c6aa3c9fe156bae1ed89d588.exe
"C:\Users\Admin\AppData\Local\Temp\e8ea3fd7c6aa3c9fe156bae1ed89d588.exe"
1⤵
PID:4648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 640
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4724

memory/4648-114-0x00000000024F0000-0x000000000257E000-memory.dmp

Download

memory/4648-115-0x0000000000400000-0x00000000008A8000-memory.dmp

Download