raccoon | 58c1b22873a1eab4f8a7cc5a26085a2968637eaa3f22e7cbe8032ad6f25bbd38

Analysis

Target

65ecbb1c38b4ac891d8a90870e115398.exe
Size

591KB
MD5

65ecbb1c38b4ac891d8a90870e115398
SHA1

78e3f1782d238b6375224a3ce7793b1cb08a95d4
SHA256

58c1b22873a1eab4f8a7cc5a26085a2968637eaa3f22e7cbe8032ad6f25bbd38
SHA512

a95b0ccaecdf007c4590efde4e56ec4e65b8d900e2070726393b912f4ef37b3761a641e7c85dfe8a9698f1bf9864afc8613d956e14414d5a0c78c00aa17a7dd9

Score

10^/10

Family

raccoon

Version

1.8.3

Botnet

a741159db87f9df2b687764994c63c4c859ea476

Attributes

url4cnc
http://178.23.190.57/hiioBlacklight1
http://91.219.236.162/hiioBlacklight1
http://185.163.47.176/hiioBlacklight1
http://193.38.54.238/hiioBlacklight1
http://74.119.192.122/hiioBlacklight1
http://91.219.236.240/hiioBlacklight1
https://t.me/hiioBlacklight1

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

240 1596 WerFault.exe 65ecbb1c38b4ac891d8a90870e115398.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

240 WerFault.exe
240 WerFault.exe
240 WerFault.exe
240 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

240 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 240 WerFault.exe

pid	pid_target	process	target process
240	1596	WerFault.exe	65ecbb1c38b4ac891d8a90870e115398.exe

pid	process
240	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	240	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

65ecbb1c38b4ac891d8a90870e115398.exe

description	pid	process	target process
PID 1596 wrote to memory of 240	1596	65ecbb1c38b4ac891d8a90870e115398.exe	WerFault.exe
PID 1596 wrote to memory of 240	1596	65ecbb1c38b4ac891d8a90870e115398.exe	WerFault.exe
PID 1596 wrote to memory of 240	1596	65ecbb1c38b4ac891d8a90870e115398.exe	WerFault.exe
PID 1596 wrote to memory of 240	1596	65ecbb1c38b4ac891d8a90870e115398.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\65ecbb1c38b4ac891d8a90870e115398.exe
"C:\Users\Admin\AppData\Local\Temp\65ecbb1c38b4ac891d8a90870e115398.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1596

memory/240-59-0x0000000000000000-mapping.dmp

Download
memory/240-60-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/1596-55-0x0000000000ADD000-0x0000000000B2C000-memory.dmp

Filesize
316KB

Download
memory/1596-56-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1596-57-0x0000000000220000-0x00000000002AF000-memory.dmp

Filesize
572KB

Download
memory/1596-58-0x0000000000400000-0x0000000000937000-memory.dmp

Filesize
5.2MB

Download