raccoon | 2d85e863666e75ccb18a02a722332a08512bfad1474b88ccead4f04f3245c654

Analysis

Target

4e3694b69f1a6e248f2bd74fc89dc046.exe
Size

509KB
MD5

4e3694b69f1a6e248f2bd74fc89dc046
SHA1

8d0fe92f31c25e4dd7db5dcd7e41ef7f3e87271f
SHA256

2d85e863666e75ccb18a02a722332a08512bfad1474b88ccead4f04f3245c654
SHA512

566d9fcef5b6b99942b200d2c9261bc6498051c77a0e278dee1906d36624b499388ff8ff5a546435b67adb1481faa17ce1499caa8ed79ef0b57737b824041acf

Score

10^/10

Family

raccoon

Version

1.8.3-hotfix

Botnet

fcdc156d3872c18d25e3ee45499599b45e492a67

Attributes

url4cnc
http://178.23.190.57/rino115sipsip
http://91.219.236.162/rino115sipsip
http://185.163.47.176/rino115sipsip
http://193.38.54.238/rino115sipsip
http://74.119.192.122/rino115sipsip
http://91.219.236.240/rino115sipsip
https://t.me/rino115sipsip

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

544 1644 WerFault.exe 4e3694b69f1a6e248f2bd74fc89dc046.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

544 WerFault.exe
544 WerFault.exe
544 WerFault.exe
544 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

544 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 544 WerFault.exe

pid	pid_target	process	target process
544	1644	WerFault.exe	4e3694b69f1a6e248f2bd74fc89dc046.exe

pid	process
544	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	544	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4e3694b69f1a6e248f2bd74fc89dc046.exe

description	pid	process	target process
PID 1644 wrote to memory of 544	1644	4e3694b69f1a6e248f2bd74fc89dc046.exe	WerFault.exe
PID 1644 wrote to memory of 544	1644	4e3694b69f1a6e248f2bd74fc89dc046.exe	WerFault.exe
PID 1644 wrote to memory of 544	1644	4e3694b69f1a6e248f2bd74fc89dc046.exe	WerFault.exe
PID 1644 wrote to memory of 544	1644	4e3694b69f1a6e248f2bd74fc89dc046.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4e3694b69f1a6e248f2bd74fc89dc046.exe
"C:\Users\Admin\AppData\Local\Temp\4e3694b69f1a6e248f2bd74fc89dc046.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1644

memory/544-59-0x0000000000000000-mapping.dmp

Download
memory/544-60-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/1644-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1644-57-0x00000000004A0000-0x000000000052F000-memory.dmp

Filesize
572KB

Download
memory/1644-56-0x0000000000330000-0x000000000037F000-memory.dmp

Filesize
316KB

Download
memory/1644-58-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download