raccoon | 596e838294aa3618fd5a6e8d71ae615f549a9df857745c41515134f748f68ef3

Analysis

Target

8fbe2112d360c6a0f0b18be369b9951a.exe
Size

534KB
MD5

8fbe2112d360c6a0f0b18be369b9951a
SHA1

fde28c60ea0938c49928d60d75f5adcd76f84903
SHA256

596e838294aa3618fd5a6e8d71ae615f549a9df857745c41515134f748f68ef3
SHA512

ec59f9b7b3d5242fb58b95dd31de7f180e006c6d37de24763b127f6e7840a78a77fbeab900a88c010c6227c25ec484ecd8381cbc989e1a96ed603f38a8e4d38f

Score

10^/10

Family

raccoon

Version

1.8.3

Botnet

243f5e3056753d9f9706258dce4f79e57c3a9c44

Attributes

url4cnc
http://178.23.190.57/agrybirdsgamerept

http://91.219.236.162/agrybirdsgamerept

http://185.163.47.176/agrybirdsgamerept

http://193.38.54.238/agrybirdsgamerept

http://74.119.192.122/agrybirdsgamerept

http://91.219.236.240/agrybirdsgamerept

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1200 2040 WerFault.exe 8fbe2112d360c6a0f0b18be369b9951a.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1200 WerFault.exe
1200 WerFault.exe
1200 WerFault.exe
1200 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1200 WerFault.exe

pid	pid_target	process	target process
1200	2040	WerFault.exe	8fbe2112d360c6a0f0b18be369b9951a.exe

description	pid	process
Token: SeDebugPrivilege	1200	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8fbe2112d360c6a0f0b18be369b9951a.exe

description	pid	process	target process
PID 2040 wrote to memory of 1200	2040	8fbe2112d360c6a0f0b18be369b9951a.exe	WerFault.exe
PID 2040 wrote to memory of 1200	2040	8fbe2112d360c6a0f0b18be369b9951a.exe	WerFault.exe
PID 2040 wrote to memory of 1200	2040	8fbe2112d360c6a0f0b18be369b9951a.exe	WerFault.exe
PID 2040 wrote to memory of 1200	2040	8fbe2112d360c6a0f0b18be369b9951a.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8fbe2112d360c6a0f0b18be369b9951a.exe
"C:\Users\Admin\AppData\Local\Temp\8fbe2112d360c6a0f0b18be369b9951a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040

memory/1200-59-0x0000000000000000-mapping.dmp

Download
memory/1200-60-0x00000000002E0000-0x0000000000340000-memory.dmp

Filesize
384KB

Download
memory/2040-55-0x0000000074F61000-0x0000000074F63000-memory.dmp

Filesize
8KB

Download
memory/2040-57-0x0000000000360000-0x00000000003EF000-memory.dmp

Filesize
572KB

Download
memory/2040-56-0x0000000000310000-0x000000000035F000-memory.dmp

Filesize
316KB

Download
memory/2040-58-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download