raccoon | 55927123aaddfc0c7d7b720e0f06aadd5bcc52d9b4955da3460b02561fb6447d

Analysis

Target

5bdc0766d86a74e58055a3940a27feca.exe
Size

560KB
MD5

5bdc0766d86a74e58055a3940a27feca
SHA1

efa03d9af76c4cc13fac9dfeaa173e662beca5d5
SHA256

55927123aaddfc0c7d7b720e0f06aadd5bcc52d9b4955da3460b02561fb6447d
SHA512

bd62121c5162ae11001d8200f7100d5eb734d69b3205adad73a7b19e96864194d4e9c385e0d97c5b22d6474b6febdee2857f9dc7c880b793a91b0c15aa33cded

Score

10^/10

Family

raccoon

Botnet

7ebf9b416b72a203df65383eec899dc689d2c3d7

Attributes

url4cnc
http://telegatt.top/agrybirdsgamerept
http://telegka.top/agrybirdsgamerept
http://telegin.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1992 1668 WerFault.exe 5bdc0766d86a74e58055a3940a27feca.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1992 WerFault.exe
1992 WerFault.exe
1992 WerFault.exe
1992 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1992 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1992 WerFault.exe

pid	pid_target	process	target process
1992	1668	WerFault.exe	5bdc0766d86a74e58055a3940a27feca.exe

pid	process
1992	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1992	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5bdc0766d86a74e58055a3940a27feca.exe

description	pid	process	target process
PID 1668 wrote to memory of 1992	1668	5bdc0766d86a74e58055a3940a27feca.exe	WerFault.exe
PID 1668 wrote to memory of 1992	1668	5bdc0766d86a74e58055a3940a27feca.exe	WerFault.exe
PID 1668 wrote to memory of 1992	1668	5bdc0766d86a74e58055a3940a27feca.exe	WerFault.exe
PID 1668 wrote to memory of 1992	1668	5bdc0766d86a74e58055a3940a27feca.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5bdc0766d86a74e58055a3940a27feca.exe
"C:\Users\Admin\AppData\Local\Temp\5bdc0766d86a74e58055a3940a27feca.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1668

memory/1668-60-0x000000000030B000-0x000000000035A000-memory.dmp

Filesize
316KB

Download
memory/1668-61-0x0000000075B31000-0x0000000075B33000-memory.dmp

Filesize
8KB

Download
memory/1668-62-0x0000000001770000-0x00000000017FE000-memory.dmp

Filesize
568KB

Download
memory/1668-63-0x0000000000400000-0x00000000016FF000-memory.dmp

Filesize
19.0MB

Download
memory/1992-64-0x0000000000000000-mapping.dmp

Download
memory/1992-65-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download