raccoon | 97dbb2b9d161dd2b5f26eb48acef6ef70701b75a75b2d281e3dbb7fd946de319

Analysis

Target
07dd2cc418847864ac674a4090105c24.exe
Size 582KB
Sample211017-lbb12sdchp
SHA256 97dbb2b9d161dd2b5f26eb48acef6ef70701b75a75b2d281e3dbb7fd946de319
MD5 07dd2cc418847864ac674a4090105c24
SHA1 29b39aec2281e9db7f7ed4491f0b5251890f50a0
SHA512 853bca78c7c2711a4e7e1f10c31f01bb1f4580823fb91e46c1a5e76a435e5c0cafb1d8c91a86b6601f33594efbc97f5171daa86f92b2d83cba2c001e62f5ad9f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Attributes

url4cnc
http://telegatt.top/jdiamond13

http://telegka.top/jdiamond13

http://telegin.top/jdiamond13

https://t.me/jdiamond13

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4004 created 3524	4004	WerFault.exe	69

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4004	3524	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\07dd2cc418847864ac674a4090105c24.exe
"C:\Users\Admin\AppData\Local\Temp\07dd2cc418847864ac674a4090105c24.exe"
1⤵
PID:3524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 848
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4004

memory/3524-115-0x00000000008F9000-0x0000000000948000-memory.dmp

Download

memory/3524-116-0x0000000002450000-0x00000000024DE000-memory.dmp

Download

memory/3524-117-0x0000000000400000-0x00000000007C3000-memory.dmp

Download