raccoon | 6f391d149f103ec2e7eb5af33aa119d7977caa80a815d388044d50abc0607a72

Analysis

Target
94cdb7d747fb129a710b25bb4044b5a7.exe
Size 566KB
Sample211113-259r6sffb3
SHA256 6f391d149f103ec2e7eb5af33aa119d7977caa80a815d388044d50abc0607a72
MD5 94cdb7d747fb129a710b25bb4044b5a7
SHA1 99c604bacdd53f192b102c3bd08da41fe6f29f6a
SHA512 300702ed891af245aceb6fce471ddf570ee7601670e303a9dc5df49eeca8a6cf1d84bbc0aac7f0392147c6da84b3557467a63542d7359c42e632db52dc1c721c
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

Attributes

url4cnc
http://91.219.236.27/agrybirdsgamerept

http://5.181.156.92/agrybirdsgamerept

http://91.219.236.207/agrybirdsgamerept

http://185.225.19.18/agrybirdsgamerept

http://91.219.237.227/agrybirdsgamerept

http://185.163.47.176/agrybirdsgamerept

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4088 created 1792	4088	WerFault.exe	67

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4088	1792	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\94cdb7d747fb129a710b25bb4044b5a7.exe
"C:\Users\Admin\AppData\Local\Temp\94cdb7d747fb129a710b25bb4044b5a7.exe"
1⤵
PID:1792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 800
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4088

memory/1792-116-0x0000000004570000-0x00000000045FF000-memory.dmp

Download

memory/1792-117-0x0000000000400000-0x00000000027B5000-memory.dmp

Download