raccoon | b669f641d898cd6f15a264e73ba63d638915815b418913237ddfde314abb1898

Analysis

Target
0084fcf83e2875ea3da9af69855c5ed2.exe
Size 488KB
Sample211026-s1ea2aaadj
SHA256 b669f641d898cd6f15a264e73ba63d638915815b418913237ddfde314abb1898
MD5 0084fcf83e2875ea3da9af69855c5ed2
SHA1 81c16e4f61537804a3d12c291f9c040a0cca2b95
SHA512 6b712a36a6bc474c41323cfe776801d21482a49351423aad7f8df1a8448a10a15f6521540d06b492ef84076be3c0bf606e18a2be634418812ff383f25011acbd
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Attributes

url4cnc
http://telegin.top/jdiamond13

http://ttmirror.top/jdiamond13

http://teletele.top/jdiamond13

http://telegalive.top/jdiamond13

http://toptelete.top/jdiamond13

http://telegraf.top/jdiamond13

https://t.me/jdiamond13

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4544 created 2860	4544	WerFault.exe	67

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4544	2860	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\0084fcf83e2875ea3da9af69855c5ed2.exe
"C:\Users\Admin\AppData\Local\Temp\0084fcf83e2875ea3da9af69855c5ed2.exe"
1⤵
PID:2860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 1000
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4544

memory/2860-116-0x0000000004BA0000-0x0000000004C2E000-memory.dmp

Download

memory/2860-115-0x0000000004B50000-0x0000000004B9E000-memory.dmp

Download

memory/2860-117-0x0000000000400000-0x0000000002F40000-memory.dmp

Download