raccoon | 6540db4c80c867fd643233e553267254b7d7b4f8bece4a32bd99d4c2f128b023

Analysis

Target

6baf8e82b31cf3774e2983ede02842c4.exe
Size

464KB
MD5

6baf8e82b31cf3774e2983ede02842c4
SHA1

1c650b87c4f7c38ecc81e54a2816677ed8867db2
SHA256

6540db4c80c867fd643233e553267254b7d7b4f8bece4a32bd99d4c2f128b023
SHA512

9a66a749f916774fe20eb18fd5343e4d1bca54e0defcf2c0f8cf260aa2ed2586afb7ae677724a8c1de6523b31fc3c97e9166de1b15d40223c053e4422285577e

Score

10^/10

Family

raccoon

Botnet

60e59be328fbd2ebac1839ea99411dccb00a6f49

Attributes

url4cnc
http://telegin.top/agrybirdsgamerept
http://ttmirror.top/agrybirdsgamerept
http://teletele.top/agrybirdsgamerept
http://telegalive.top/agrybirdsgamerept
http://toptelete.top/agrybirdsgamerept
http://telegraf.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1332 844 WerFault.exe 6baf8e82b31cf3774e2983ede02842c4.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1332 WerFault.exe
1332 WerFault.exe
1332 WerFault.exe
1332 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1332 WerFault.exe

pid	pid_target	process	target process
1332	844	WerFault.exe	6baf8e82b31cf3774e2983ede02842c4.exe

description	pid	process
Token: SeDebugPrivilege	1332	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6baf8e82b31cf3774e2983ede02842c4.exe

description	pid	process	target process
PID 844 wrote to memory of 1332	844	6baf8e82b31cf3774e2983ede02842c4.exe	WerFault.exe
PID 844 wrote to memory of 1332	844	6baf8e82b31cf3774e2983ede02842c4.exe	WerFault.exe
PID 844 wrote to memory of 1332	844	6baf8e82b31cf3774e2983ede02842c4.exe	WerFault.exe
PID 844 wrote to memory of 1332	844	6baf8e82b31cf3774e2983ede02842c4.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\6baf8e82b31cf3774e2983ede02842c4.exe
"C:\Users\Admin\AppData\Local\Temp\6baf8e82b31cf3774e2983ede02842c4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:844

memory/844-55-0x0000000075B71000-0x0000000075B73000-memory.dmp

Filesize
8KB

Download
memory/844-56-0x0000000000220000-0x000000000026E000-memory.dmp

Filesize
312KB

Download
memory/844-57-0x0000000000400000-0x0000000002F3A000-memory.dmp

Filesize
43.2MB

Download
memory/844-58-0x0000000000340000-0x00000000003CE000-memory.dmp

Filesize
568KB

Download
memory/1332-59-0x0000000000000000-mapping.dmp

Download
memory/1332-60-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download