raccoon | 4ac1fd5714d68c3a015611027bd42bd354207d7f9c8417a63a4da31295580ffd

Analysis

Target

5fe07134abda38e8870c74150caa6b68.exe
Size

465KB
MD5

5fe07134abda38e8870c74150caa6b68
SHA1

2e50a2dd334ce25c29c09f89e71c42b3242de3ac
SHA256

4ac1fd5714d68c3a015611027bd42bd354207d7f9c8417a63a4da31295580ffd
SHA512

f4088ff3414956574b82f7f8b6f5648eeb924a9c5c9dab687c6187a765aa24652219185c8da7d0214fef566b19ca357fb55a9a878becd4c76f8b97e12006c088

Score

10^/10

Family

raccoon

Botnet

60e59be328fbd2ebac1839ea99411dccb00a6f49

Attributes

url4cnc
http://telegin.top/agrybirdsgamerept
http://ttmirror.top/agrybirdsgamerept
http://teletele.top/agrybirdsgamerept
http://telegalive.top/agrybirdsgamerept
http://toptelete.top/agrybirdsgamerept
http://telegraf.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

692 1720 WerFault.exe 5fe07134abda38e8870c74150caa6b68.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

692 WerFault.exe
692 WerFault.exe
692 WerFault.exe
692 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 692 WerFault.exe

pid	pid_target	process	target process
692	1720	WerFault.exe	5fe07134abda38e8870c74150caa6b68.exe

description	pid	process
Token: SeDebugPrivilege	692	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5fe07134abda38e8870c74150caa6b68.exe

description	pid	process	target process
PID 1720 wrote to memory of 692	1720	5fe07134abda38e8870c74150caa6b68.exe	WerFault.exe
PID 1720 wrote to memory of 692	1720	5fe07134abda38e8870c74150caa6b68.exe	WerFault.exe
PID 1720 wrote to memory of 692	1720	5fe07134abda38e8870c74150caa6b68.exe	WerFault.exe
PID 1720 wrote to memory of 692	1720	5fe07134abda38e8870c74150caa6b68.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5fe07134abda38e8870c74150caa6b68.exe
"C:\Users\Admin\AppData\Local\Temp\5fe07134abda38e8870c74150caa6b68.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1720

memory/692-59-0x0000000000000000-mapping.dmp

Download
memory/692-60-0x0000000001F30000-0x0000000001F31000-memory.dmp

Filesize
4KB

Download
memory/1720-55-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/1720-56-0x0000000000220000-0x000000000026E000-memory.dmp

Filesize
312KB

Download
memory/1720-57-0x00000000048A0000-0x000000000492E000-memory.dmp

Filesize
568KB

Download
memory/1720-58-0x0000000000400000-0x0000000002F3A000-memory.dmp

Filesize
43.2MB

Download