raccoon | 58c1b22873a1eab4f8a7cc5a26085a2968637eaa3f22e7cbe8032ad6f25bbd38

Analysis

Target

65ecbb1c38b4ac891d8a90870e115398.exe
Size

591KB
MD5

65ecbb1c38b4ac891d8a90870e115398
SHA1

78e3f1782d238b6375224a3ce7793b1cb08a95d4
SHA256

58c1b22873a1eab4f8a7cc5a26085a2968637eaa3f22e7cbe8032ad6f25bbd38
SHA512

a95b0ccaecdf007c4590efde4e56ec4e65b8d900e2070726393b912f4ef37b3761a641e7c85dfe8a9698f1bf9864afc8613d956e14414d5a0c78c00aa17a7dd9

Score

10^/10

Family

raccoon

Version

1.8.3

Botnet

a741159db87f9df2b687764994c63c4c859ea476

Attributes

url4cnc
http://178.23.190.57/hiioBlacklight1

http://91.219.236.162/hiioBlacklight1

http://185.163.47.176/hiioBlacklight1

http://193.38.54.238/hiioBlacklight1

http://74.119.192.122/hiioBlacklight1

http://91.219.236.240/hiioBlacklight1

https://t.me/hiioBlacklight1

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

992 1880 WerFault.exe 65ecbb1c38b4ac891d8a90870e115398.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

992 WerFault.exe
992 WerFault.exe
992 WerFault.exe
992 WerFault.exe
992 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

992 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 992 WerFault.exe

pid	pid_target	process	target process
992	1880	WerFault.exe	65ecbb1c38b4ac891d8a90870e115398.exe

pid	process
992	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	992	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

65ecbb1c38b4ac891d8a90870e115398.exe

description	pid	process	target process
PID 1880 wrote to memory of 992	1880	65ecbb1c38b4ac891d8a90870e115398.exe	WerFault.exe
PID 1880 wrote to memory of 992	1880	65ecbb1c38b4ac891d8a90870e115398.exe	WerFault.exe
PID 1880 wrote to memory of 992	1880	65ecbb1c38b4ac891d8a90870e115398.exe	WerFault.exe
PID 1880 wrote to memory of 992	1880	65ecbb1c38b4ac891d8a90870e115398.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\65ecbb1c38b4ac891d8a90870e115398.exe
"C:\Users\Admin\AppData\Local\Temp\65ecbb1c38b4ac891d8a90870e115398.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1880

memory/992-58-0x0000000000000000-mapping.dmp

Download
memory/992-60-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1880-55-0x0000000000A7D000-0x0000000000ACC000-memory.dmp

Filesize
316KB

Download
memory/1880-56-0x0000000075D41000-0x0000000075D43000-memory.dmp

Filesize
8KB

Download
memory/1880-57-0x0000000000220000-0x00000000002AF000-memory.dmp

Filesize
572KB

Download
memory/1880-59-0x0000000000400000-0x0000000000937000-memory.dmp

Filesize
5.2MB

Download