raccoon | fdf35843d43d508eeb708a3ebe2e636e8af09cc723db0327db6e55c54507c73d

Analysis

Target
f1ebd4d0dc9e4fe7c2e0fea0a54a996e.exe
Size 431KB
Sample211102-hcexjsbgh3
SHA256 fdf35843d43d508eeb708a3ebe2e636e8af09cc723db0327db6e55c54507c73d
MD5 f1ebd4d0dc9e4fe7c2e0fea0a54a996e
SHA1 e2f9388e5d8548d5aac369c4890f044b5b93d96f
SHA512 57032a8666d097983bf2b54b7984a7bd0ce4be5007614f8888f9e697925ea302fd6cd33ea3705fff7b698a528cfebc77364b03ef3ab0a89622e4c5f21012f5e5
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Attributes

url4cnc
http://telegin.top/jdiamond13

http://ttmirror.top/jdiamond13

http://teletele.top/jdiamond13

http://telegalive.top/jdiamond13

http://toptelete.top/jdiamond13

http://telegraf.top/jdiamond13

https://t.me/jdiamond13

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 604 created 656	604	WerFault.exe	67

Program crash 1 IoCs

pid	pid_target	Process	procid_target
604	656	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\f1ebd4d0dc9e4fe7c2e0fea0a54a996e.exe
"C:\Users\Admin\AppData\Local\Temp\f1ebd4d0dc9e4fe7c2e0fea0a54a996e.exe"
1⤵
PID:656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 1272
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:604

memory/656-116-0x0000000002100000-0x000000000218E000-memory.dmp

Download

memory/656-115-0x00000000020B0000-0x00000000020FE000-memory.dmp

Download

memory/656-117-0x0000000000400000-0x0000000000491000-memory.dmp

Download