raccoon | d6001655c8a81f14b419dd0db6ef64767a36da0ad2c34920e01ade9d007ac76d

Analysis

Target
7e0942e119d17ce6d7fbe7c76354349f.exe
Size 543KB
Sample211103-yyvswsehc7
SHA256 d6001655c8a81f14b419dd0db6ef64767a36da0ad2c34920e01ade9d007ac76d
MD5 7e0942e119d17ce6d7fbe7c76354349f
SHA1 e6653fea2621ed1dbe65889fb4b963a87200d60e
SHA512 d49f6c8fb6dda85b1dc8064b63ee782ff3731bc5bb9a5e51581890158c5f3c14a26d7892435f87461d806cb7cd5d8bfbc4f7b537598e834aef68f0a96fb86e74
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Attributes

url4cnc
http://telegin.top/jdiamond13

http://ttmirror.top/jdiamond13

http://teletele.top/jdiamond13

http://telegalive.top/jdiamond13

http://toptelete.top/jdiamond13

http://telegraf.top/jdiamond13

https://t.me/jdiamond13

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 820 created 3032	820	WerFault.exe	68

Program crash 1 IoCs

pid	pid_target	Process	procid_target
820	3032	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\7e0942e119d17ce6d7fbe7c76354349f.exe
"C:\Users\Admin\AppData\Local\Temp\7e0942e119d17ce6d7fbe7c76354349f.exe"
1⤵
PID:3032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 1280
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:820

memory/3032-116-0x00000000026B0000-0x000000000273E000-memory.dmp

Download

memory/3032-117-0x0000000000400000-0x000000000092C000-memory.dmp

Download