raccoon | d8954e41c48d31ed2ba00ff97fc184cbf0a7621f7c387ad6a74b6e746bf034dd

Analysis

Target
006645be4a1ef277d065132306830565.exe
Size 459KB
Sample211030-aebnxaece5
SHA256 d8954e41c48d31ed2ba00ff97fc184cbf0a7621f7c387ad6a74b6e746bf034dd
MD5 006645be4a1ef277d065132306830565
SHA1 24398e53066d63047db04c21fff156c642d588fd
SHA512 fab9e1ec9a66f0301806c5396589195b0c754f161630c8419fa18a143cab766f70157f5b2910bc0090a502519f3368b2b6c91cd05be748d657518c6a68174b94
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Attributes

url4cnc
http://telegin.top/jdiamond13

http://ttmirror.top/jdiamond13

http://teletele.top/jdiamond13

http://telegalive.top/jdiamond13

http://toptelete.top/jdiamond13

http://telegraf.top/jdiamond13

https://t.me/jdiamond13

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4524 created 3152	4524	WerFault.exe	67

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4524	3152	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\006645be4a1ef277d065132306830565.exe
"C:\Users\Admin\AppData\Local\Temp\006645be4a1ef277d065132306830565.exe"
1⤵
PID:3152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 936
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4524

memory/3152-116-0x0000000000710000-0x000000000079E000-memory.dmp

Download

memory/3152-115-0x00000000004A0000-0x00000000004EE000-memory.dmp

Download

memory/3152-117-0x0000000000400000-0x0000000000491000-memory.dmp

Download