raccoon | 780e39283a52dab8a479fe819f1342cd8ae8c8ada87709006ac834d17e49d662

General

Target

usfive_20211024-013826.exe
Size

818KB
MD5

9589e2ff4d579cc048ad7759213a92f4
SHA1

8cfea7f492b63d606140ee52f7ea2a966ac251dc
SHA256

780e39283a52dab8a479fe819f1342cd8ae8c8ada87709006ac834d17e49d662
SHA512

9f2866786450af6843df87a6c344e4235fa628f84de765de509a735dbab423e6214d75c3bb8bbd19866d8058ca124279567a2619c8e6359dd7481928cdf7ff5c

Score

10^/10

Family

raccoon

Botnet

7c9b4504a63ed23664e38808e65948379b790395

Attributes

url4cnc
http://telegka.top/capibar
http://telegin.top/capibar
https://t.me/capibar

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Suspicious use of SetThreadContext 1 IoCs

Processes:

usfive_20211024-013826.exe

description pid process target process

PID 1488 set thread context of 1020 1488 usfive_20211024-013826.exe usfive_20211024-013826.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1828 1020 WerFault.exe usfive_20211024-013826.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1828 WerFault.exe
1828 WerFault.exe
1828 WerFault.exe
1828 WerFault.exe
1828 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1828 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1828 WerFault.exe

description	pid	process	target process
PID 1488 set thread context of 1020	1488	usfive_20211024-013826.exe	usfive_20211024-013826.exe

pid	pid_target	process	target process
1828	1020	WerFault.exe	usfive_20211024-013826.exe

pid	process
1828	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1828	WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

usfive_20211024-013826.exeusfive_20211024-013826.exe

description	pid	process	target process
PID 1488 wrote to memory of 1020	1488	usfive_20211024-013826.exe	usfive_20211024-013826.exe
PID 1488 wrote to memory of 1020	1488	usfive_20211024-013826.exe	usfive_20211024-013826.exe
PID 1488 wrote to memory of 1020	1488	usfive_20211024-013826.exe	usfive_20211024-013826.exe
PID 1488 wrote to memory of 1020	1488	usfive_20211024-013826.exe	usfive_20211024-013826.exe
PID 1488 wrote to memory of 1020	1488	usfive_20211024-013826.exe	usfive_20211024-013826.exe
PID 1488 wrote to memory of 1020	1488	usfive_20211024-013826.exe	usfive_20211024-013826.exe
PID 1488 wrote to memory of 1020	1488	usfive_20211024-013826.exe	usfive_20211024-013826.exe
PID 1488 wrote to memory of 1020	1488	usfive_20211024-013826.exe	usfive_20211024-013826.exe
PID 1488 wrote to memory of 1020	1488	usfive_20211024-013826.exe	usfive_20211024-013826.exe
PID 1488 wrote to memory of 1020	1488	usfive_20211024-013826.exe	usfive_20211024-013826.exe
PID 1020 wrote to memory of 1828	1020	usfive_20211024-013826.exe	WerFault.exe
PID 1020 wrote to memory of 1828	1020	usfive_20211024-013826.exe	WerFault.exe
PID 1020 wrote to memory of 1828	1020	usfive_20211024-013826.exe	WerFault.exe
PID 1020 wrote to memory of 1828	1020	usfive_20211024-013826.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\usfive_20211024-013826.exe
"C:\Users\Admin\AppData\Local\Temp\usfive_20211024-013826.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1020

memory/1020-65-0x0000000000340000-0x00000000003CE000-memory.dmp

Filesize
568KB

Download
memory/1020-63-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/1020-67-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/1020-60-0x0000000000457320-mapping.dmp

Download
memory/1020-66-0x0000000076231000-0x0000000076233000-memory.dmp

Filesize
8KB

Download
memory/1020-57-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/1020-62-0x0000000002E88000-0x0000000002ED7000-memory.dmp

Filesize
316KB

Download
memory/1020-64-0x0000000000400000-0x0000000002DE8000-memory.dmp

Filesize
41.9MB

Download
memory/1488-59-0x0000000000400000-0x00000000008FC000-memory.dmp

Filesize
5.0MB

Download
memory/1488-55-0x0000000000220000-0x00000000002A8000-memory.dmp

Filesize
544KB

Download
memory/1488-56-0x0000000000AB9000-0x0000000000B21000-memory.dmp

Filesize
416KB

Download
memory/1488-61-0x00000000009B0000-0x0000000000A43000-memory.dmp

Filesize
588KB

Download
memory/1488-58-0x0000000000900000-0x00000000009AD000-memory.dmp

Filesize
692KB

Download
memory/1828-68-0x0000000000000000-mapping.dmp

Download
memory/1828-69-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download