raccoon | 58524862222e01692b89045f1a8c41cd7c90c31fdb7a8de92ef3b65ef723bb44

Analysis

Target

fe838437ce22f11f4bf1f98f941b63a3.exe
Size

464KB
MD5

fe838437ce22f11f4bf1f98f941b63a3
SHA1

e5ea5e56257e49f7d982afe4b9154ff05391045b
SHA256

58524862222e01692b89045f1a8c41cd7c90c31fdb7a8de92ef3b65ef723bb44
SHA512

1fb6158af37466f0f14b38d746cbc235fe1369eaa1840c32999028ecb447f3548bc17555e63580426f480bd4bb66910327af0e46cf5be86a7fafabedace9f7f1

Score

10^/10

Family

raccoon

Botnet

60e59be328fbd2ebac1839ea99411dccb00a6f49

Attributes

url4cnc
http://telegin.top/agrybirdsgamerept
http://ttmirror.top/agrybirdsgamerept
http://teletele.top/agrybirdsgamerept
http://telegalive.top/agrybirdsgamerept
http://toptelete.top/agrybirdsgamerept
http://telegraf.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

816 1388 WerFault.exe fe838437ce22f11f4bf1f98f941b63a3.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

816 WerFault.exe
816 WerFault.exe
816 WerFault.exe
816 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 816 WerFault.exe

pid	pid_target	process	target process
816	1388	WerFault.exe	fe838437ce22f11f4bf1f98f941b63a3.exe

description	pid	process
Token: SeDebugPrivilege	816	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fe838437ce22f11f4bf1f98f941b63a3.exe

description	pid	process	target process
PID 1388 wrote to memory of 816	1388	fe838437ce22f11f4bf1f98f941b63a3.exe	WerFault.exe
PID 1388 wrote to memory of 816	1388	fe838437ce22f11f4bf1f98f941b63a3.exe	WerFault.exe
PID 1388 wrote to memory of 816	1388	fe838437ce22f11f4bf1f98f941b63a3.exe	WerFault.exe
PID 1388 wrote to memory of 816	1388	fe838437ce22f11f4bf1f98f941b63a3.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fe838437ce22f11f4bf1f98f941b63a3.exe
"C:\Users\Admin\AppData\Local\Temp\fe838437ce22f11f4bf1f98f941b63a3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1388

memory/816-58-0x0000000000000000-mapping.dmp

Download
memory/816-59-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/1388-54-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/1388-55-0x0000000000220000-0x000000000026E000-memory.dmp

Filesize
312KB

Download
memory/1388-56-0x0000000000370000-0x00000000003FE000-memory.dmp

Filesize
568KB

Download
memory/1388-57-0x0000000000400000-0x0000000002F3A000-memory.dmp

Filesize
43.2MB

Download