raccoon | 9308d06fec62ea75d5d1a5a86114ee2b326c543f9338ea5216ef88fb31af241a

Analysis

Target

9308d06fec62ea75d5d1a5a86114ee2b326c543f9338ea5216ef88fb31af241a.exe
Size

500KB
MD5

8e4900be6c568c8833b9020c97d5c26d
SHA1

c012f4e440551ff055ba03e4261b8cbcac926bf4
SHA256

9308d06fec62ea75d5d1a5a86114ee2b326c543f9338ea5216ef88fb31af241a
SHA512

0f7d31976efdea8d6c1a24aa90c2a8a17498b8a4d051b0cca20659f1870685b55c89e83f7de0c9eb3c142ba4e87aed996de2f28b0fcc62fdec46d75574fa3ae1

Score

10^/10

Family

raccoon

Version

1.8.3-hotfix

Botnet

675718a5f2ce6d3cacf6cb04a512f5637eae995f

Attributes

url4cnc
http://91.219.236.27/agrybirdsgamerept
http://5.181.156.92/agrybirdsgamerept
http://91.219.236.207/agrybirdsgamerept
http://185.225.19.18/agrybirdsgamerept
http://91.219.237.227/agrybirdsgamerept
http://185.163.47.176/agrybirdsgamerept

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

360 1728 WerFault.exe 9308d06fec62ea75d5d1a5a86114ee2b326c543f9338ea5216ef88fb31af241a.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

360 WerFault.exe
360 WerFault.exe
360 WerFault.exe
360 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 360 WerFault.exe

pid	pid_target	process	target process
360	1728	WerFault.exe	9308d06fec62ea75d5d1a5a86114ee2b326c543f9338ea5216ef88fb31af241a.exe

description	pid	process
Token: SeDebugPrivilege	360	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

9308d06fec62ea75d5d1a5a86114ee2b326c543f9338ea5216ef88fb31af241a.exe

description	pid	process	target process
PID 1728 wrote to memory of 360	1728	9308d06fec62ea75d5d1a5a86114ee2b326c543f9338ea5216ef88fb31af241a.exe	WerFault.exe
PID 1728 wrote to memory of 360	1728	9308d06fec62ea75d5d1a5a86114ee2b326c543f9338ea5216ef88fb31af241a.exe	WerFault.exe
PID 1728 wrote to memory of 360	1728	9308d06fec62ea75d5d1a5a86114ee2b326c543f9338ea5216ef88fb31af241a.exe	WerFault.exe
PID 1728 wrote to memory of 360	1728	9308d06fec62ea75d5d1a5a86114ee2b326c543f9338ea5216ef88fb31af241a.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9308d06fec62ea75d5d1a5a86114ee2b326c543f9338ea5216ef88fb31af241a.exe
"C:\Users\Admin\AppData\Local\Temp\9308d06fec62ea75d5d1a5a86114ee2b326c543f9338ea5216ef88fb31af241a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728

memory/360-59-0x0000000000000000-mapping.dmp

Download
memory/360-60-0x0000000000320000-0x00000000003B1000-memory.dmp

Filesize
580KB

Download
memory/1728-55-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download
memory/1728-56-0x0000000000220000-0x000000000026F000-memory.dmp

Filesize
316KB

Download
memory/1728-57-0x00000000004A0000-0x000000000052F000-memory.dmp

Filesize
572KB

Download
memory/1728-58-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download