raccoon | 64771bf8e0a5d9626795cf4f1172cfaed594ce61defb10f9057fd14e83dff4c5

Analysis

Target

cf6a0a6ec4292770c93bf9b8ada7af4b.exe
Size

450KB
MD5

cf6a0a6ec4292770c93bf9b8ada7af4b
SHA1

a540699e685cfa98935aff5b52a1dd9fd8ec7783
SHA256

64771bf8e0a5d9626795cf4f1172cfaed594ce61defb10f9057fd14e83dff4c5
SHA512

a72b56d0a64ca21fec21e7ab0c695d18e852d198b19c49516d32e95baa40684334bb579e2644c2727fa2a966858299dd0342d9a4ae1c8d485c73734b860af46b

Score

10^/10

Family

raccoon

Botnet

60e59be328fbd2ebac1839ea99411dccb00a6f49

Attributes

url4cnc
http://telegin.top/agrybirdsgamerept
http://ttmirror.top/agrybirdsgamerept
http://teletele.top/agrybirdsgamerept
http://telegalive.top/agrybirdsgamerept
http://toptelete.top/agrybirdsgamerept
http://telegraf.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

288 1864 WerFault.exe cf6a0a6ec4292770c93bf9b8ada7af4b.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

288 WerFault.exe
288 WerFault.exe
288 WerFault.exe
288 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 288 WerFault.exe

pid	pid_target	process	target process
288	1864	WerFault.exe	cf6a0a6ec4292770c93bf9b8ada7af4b.exe

description	pid	process
Token: SeDebugPrivilege	288	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cf6a0a6ec4292770c93bf9b8ada7af4b.exe

description	pid	process	target process
PID 1864 wrote to memory of 288	1864	cf6a0a6ec4292770c93bf9b8ada7af4b.exe	WerFault.exe
PID 1864 wrote to memory of 288	1864	cf6a0a6ec4292770c93bf9b8ada7af4b.exe	WerFault.exe
PID 1864 wrote to memory of 288	1864	cf6a0a6ec4292770c93bf9b8ada7af4b.exe	WerFault.exe
PID 1864 wrote to memory of 288	1864	cf6a0a6ec4292770c93bf9b8ada7af4b.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\cf6a0a6ec4292770c93bf9b8ada7af4b.exe
"C:\Users\Admin\AppData\Local\Temp\cf6a0a6ec4292770c93bf9b8ada7af4b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1864

memory/288-58-0x0000000000000000-mapping.dmp

Download
memory/288-59-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/1864-54-0x0000000076A81000-0x0000000076A83000-memory.dmp

Filesize
8KB

Download
memory/1864-56-0x0000000000270000-0x00000000002FE000-memory.dmp

Filesize
568KB

Download
memory/1864-55-0x0000000000220000-0x000000000026E000-memory.dmp

Filesize
312KB

Download
memory/1864-57-0x0000000000400000-0x0000000002F36000-memory.dmp

Filesize
43.2MB

Download