raccoon | 170bb6d431fe180a14501b40c6ab3882c49c2a0f8c120189a99762f89746fe58

General

Target

ac621a1227b6f66fa11197ba6fd712ce.exe
Size

465KB
MD5

ac621a1227b6f66fa11197ba6fd712ce
SHA1

8cb3841a17fb0bcd8317dc1973cc894aae430255
SHA256

170bb6d431fe180a14501b40c6ab3882c49c2a0f8c120189a99762f89746fe58
SHA512

d7d8c941521406fb8fa0444462cb58deec237169a808ab6b6067839061dfaea316e790e18acd4adaa5c78fb16153538bdeb76d038bdff57e147168c30760c56e

Score

10^/10

Family

raccoon

Botnet

60e59be328fbd2ebac1839ea99411dccb00a6f49

Attributes

url4cnc
http://telegin.top/agrybirdsgamerept
http://ttmirror.top/agrybirdsgamerept
http://teletele.top/agrybirdsgamerept
http://telegalive.top/agrybirdsgamerept
http://toptelete.top/agrybirdsgamerept
http://telegraf.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1420 1088 WerFault.exe ac621a1227b6f66fa11197ba6fd712ce.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1420 WerFault.exe
1420 WerFault.exe
1420 WerFault.exe
1420 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1420 WerFault.exe

pid	pid_target	process	target process
1420	1088	WerFault.exe	ac621a1227b6f66fa11197ba6fd712ce.exe

description	pid	process
Token: SeDebugPrivilege	1420	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ac621a1227b6f66fa11197ba6fd712ce.exe

description	pid	process	target process
PID 1088 wrote to memory of 1420	1088	ac621a1227b6f66fa11197ba6fd712ce.exe	WerFault.exe
PID 1088 wrote to memory of 1420	1088	ac621a1227b6f66fa11197ba6fd712ce.exe	WerFault.exe
PID 1088 wrote to memory of 1420	1088	ac621a1227b6f66fa11197ba6fd712ce.exe	WerFault.exe
PID 1088 wrote to memory of 1420	1088	ac621a1227b6f66fa11197ba6fd712ce.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ac621a1227b6f66fa11197ba6fd712ce.exe
"C:\Users\Admin\AppData\Local\Temp\ac621a1227b6f66fa11197ba6fd712ce.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1088

memory/1088-55-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download
memory/1088-56-0x0000000000220000-0x000000000026E000-memory.dmp

Filesize
312KB

Download
memory/1088-57-0x0000000000310000-0x000000000039E000-memory.dmp

Filesize
568KB

Download
memory/1088-58-0x0000000000400000-0x0000000002F3A000-memory.dmp

Filesize
43.2MB

Download
memory/1420-59-0x0000000000000000-mapping.dmp

Download
memory/1420-60-0x00000000002A0000-0x0000000000300000-memory.dmp

Filesize
384KB

Download