raccoon | d1e29d1206b6d74e8617f768bb43aea7d352a477b743ae98205909109983f645

General

Target

1ffb547f14e373312937f6d8c60fffd5.exe
Size

589KB
MD5

1ffb547f14e373312937f6d8c60fffd5
SHA1

44fde78fa67818a9420477cf321b38a280888bbb
SHA256

d1e29d1206b6d74e8617f768bb43aea7d352a477b743ae98205909109983f645
SHA512

c60e35398fb67b0840b904861051ec1b2e829dcb0557fb2cfee6a0a0978cb180c7f74c1d60194ecfd49c01a226ad761b06b306675bb02dceb4b3a770e4d1f9e4

Score

10^/10

Family

raccoon

Botnet

60e59be328fbd2ebac1839ea99411dccb00a6f49

Attributes

url4cnc
http://telegin.top/agrybirdsgamerept
http://ttmirror.top/agrybirdsgamerept
http://teletele.top/agrybirdsgamerept
http://telegalive.top/agrybirdsgamerept
http://toptelete.top/agrybirdsgamerept
http://telegraf.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1740 1136 WerFault.exe 1ffb547f14e373312937f6d8c60fffd5.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1740 WerFault.exe
1740 WerFault.exe
1740 WerFault.exe
1740 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1740 WerFault.exe

pid	pid_target	process	target process
1740	1136	WerFault.exe	1ffb547f14e373312937f6d8c60fffd5.exe

description	pid	process
Token: SeDebugPrivilege	1740	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1ffb547f14e373312937f6d8c60fffd5.exe

description	pid	process	target process
PID 1136 wrote to memory of 1740	1136	1ffb547f14e373312937f6d8c60fffd5.exe	WerFault.exe
PID 1136 wrote to memory of 1740	1136	1ffb547f14e373312937f6d8c60fffd5.exe	WerFault.exe
PID 1136 wrote to memory of 1740	1136	1ffb547f14e373312937f6d8c60fffd5.exe	WerFault.exe
PID 1136 wrote to memory of 1740	1136	1ffb547f14e373312937f6d8c60fffd5.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1ffb547f14e373312937f6d8c60fffd5.exe
"C:\Users\Admin\AppData\Local\Temp\1ffb547f14e373312937f6d8c60fffd5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1136

memory/1136-55-0x0000000002D0D000-0x0000000002D5C000-memory.dmp

Filesize
316KB

Download
memory/1136-56-0x0000000075F41000-0x0000000075F43000-memory.dmp

Filesize
8KB

Download
memory/1136-57-0x0000000000330000-0x00000000003BE000-memory.dmp

Filesize
568KB

Download
memory/1136-58-0x0000000000400000-0x0000000002BED000-memory.dmp

Filesize
39.9MB

Download
memory/1740-59-0x0000000000000000-mapping.dmp

Download
memory/1740-60-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download