raccoon | 33d3b2f2022f7bc8f6d5563a962d41fbb984b212b9e09f0ddf5fe7e9a44a8d34

Analysis

Target
353e1504e161afde5389d5f8945511e4.exe
Size 593KB
Sample211018-ndqnbsedcl
SHA256 33d3b2f2022f7bc8f6d5563a962d41fbb984b212b9e09f0ddf5fe7e9a44a8d34
MD5 353e1504e161afde5389d5f8945511e4
SHA1 ee28c5d8de68edc83a76880046834bb16eb8c9f0
SHA512 9623fa87c284e0f17f21712d20b65d7b86e36611e5dc432eaeb60600755145817472059582e87e8c30ebc526cc6369f74298f7bcfe7c7caa36127d2d68d9a8cd
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Attributes

url4cnc
http://telegatt.top/agrybirdsgamerept

http://telegka.top/agrybirdsgamerept

http://telegin.top/agrybirdsgamerept

https://t.me/agrybirdsgamerept

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3452 created 3144	3452	WerFault.exe	69

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3452	3144	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\353e1504e161afde5389d5f8945511e4.exe
"C:\Users\Admin\AppData\Local\Temp\353e1504e161afde5389d5f8945511e4.exe"
1⤵
PID:3144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 988
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3452

memory/3144-115-0x00000000008A6000-0x00000000008F5000-memory.dmp

Download

memory/3144-117-0x0000000000400000-0x00000000007C6000-memory.dmp

Download

memory/3144-116-0x0000000002400000-0x000000000248E000-memory.dmp

Download