raccoon | d004a793d71800e6358a7dc5322b8bc226739828bb9dfe8d2f62387412670d70

General

Target

2afcb892c0114000ef9664e45d1aea15.exe
Size

465KB
MD5

2afcb892c0114000ef9664e45d1aea15
SHA1

b6f0dd26ffce6dd5cd74779cdd61b208ed0a6414
SHA256

d004a793d71800e6358a7dc5322b8bc226739828bb9dfe8d2f62387412670d70
SHA512

e7d702abc0b7c130b5d26736701597998cf0c55ce5533806a23380c742416be7a59b49f391ea2cff0a3fc75984ba3714506a918a32077944ddb0c0ef745395b5

Score

10^/10

Family

raccoon

Botnet

60e59be328fbd2ebac1839ea99411dccb00a6f49

Attributes

url4cnc
http://telegin.top/agrybirdsgamerept
http://ttmirror.top/agrybirdsgamerept
http://teletele.top/agrybirdsgamerept
http://telegalive.top/agrybirdsgamerept
http://toptelete.top/agrybirdsgamerept
http://telegraf.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1832 1124 WerFault.exe 2afcb892c0114000ef9664e45d1aea15.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1832 WerFault.exe
1832 WerFault.exe
1832 WerFault.exe
1832 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1832 WerFault.exe

pid	pid_target	process	target process
1832	1124	WerFault.exe	2afcb892c0114000ef9664e45d1aea15.exe

description	pid	process
Token: SeDebugPrivilege	1832	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2afcb892c0114000ef9664e45d1aea15.exe

description	pid	process	target process
PID 1124 wrote to memory of 1832	1124	2afcb892c0114000ef9664e45d1aea15.exe	WerFault.exe
PID 1124 wrote to memory of 1832	1124	2afcb892c0114000ef9664e45d1aea15.exe	WerFault.exe
PID 1124 wrote to memory of 1832	1124	2afcb892c0114000ef9664e45d1aea15.exe	WerFault.exe
PID 1124 wrote to memory of 1832	1124	2afcb892c0114000ef9664e45d1aea15.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2afcb892c0114000ef9664e45d1aea15.exe
"C:\Users\Admin\AppData\Local\Temp\2afcb892c0114000ef9664e45d1aea15.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1124

memory/1124-55-0x0000000075F41000-0x0000000075F43000-memory.dmp

Filesize
8KB

Download
memory/1124-56-0x00000000003A0000-0x00000000003EE000-memory.dmp

Filesize
312KB

Download
memory/1124-57-0x00000000046E0000-0x000000000476E000-memory.dmp

Filesize
568KB

Download
memory/1124-58-0x0000000000400000-0x0000000002F3A000-memory.dmp

Filesize
43.2MB

Download
memory/1832-59-0x0000000000000000-mapping.dmp

Download
memory/1832-60-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download