raccoon | 0166d0fc5da4d3c12c8955d1cebe10f366cd0a0674f2a5d403e2cfc40804209e

Analysis

Target
30d55353e81d7df017139a2f0a31c9bb.exe
Size 593KB
Sample211113-x2nnbacddn
SHA256 0166d0fc5da4d3c12c8955d1cebe10f366cd0a0674f2a5d403e2cfc40804209e
MD5 30d55353e81d7df017139a2f0a31c9bb
SHA1 719ed4511b45c4a047d2de51e6882af729b473e4
SHA512 3e9114103fc42d06c538e48315b8fafbc388ab55f0676db794be87c1565a6e670b50a431fba276fcb3aceb937a7f6b1095dc476bc8c3838876d37af5063c0cde
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

Attributes

url4cnc
http://91.219.236.27/agrybirdsgamerept

http://5.181.156.92/agrybirdsgamerept

http://91.219.236.207/agrybirdsgamerept

http://185.225.19.18/agrybirdsgamerept

http://91.219.237.227/agrybirdsgamerept

http://185.163.47.176/agrybirdsgamerept

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1052 created 2716	1052	WerFault.exe	67

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1052	2716	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\30d55353e81d7df017139a2f0a31c9bb.exe
"C:\Users\Admin\AppData\Local\Temp\30d55353e81d7df017139a2f0a31c9bb.exe"
1⤵
PID:2716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 892
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1052

memory/2716-116-0x00000000048D0000-0x000000000495F000-memory.dmp

Download

memory/2716-117-0x0000000000400000-0x0000000002B8D000-memory.dmp

Download