raccoon | 30f8d690fcd9bc1e0020f6b3a916ad71e5b2df3cdb17e02e5a1565b579bf7319

Analysis

Target

066dd2538407a6ae20996556d4f67d50.exe
Size

518KB
MD5

066dd2538407a6ae20996556d4f67d50
SHA1

5586f384bb7441a529b4d4d24bb2f50578bf7f2a
SHA256

30f8d690fcd9bc1e0020f6b3a916ad71e5b2df3cdb17e02e5a1565b579bf7319
SHA512

a0500413cca66e65b5bd37a5ac444223dae2139df43c7797ec259e83825fb5b3041b32d88f460ba5092f9068b95cbf0c49200b6f60103be0ed4a09abb4f85a89

Score

10^/10

Family

raccoon

Botnet

ccba3157b9f42051adf38fbb8f5d0aca7f2b7366

Attributes

url4cnc
http://185.163.204.81/nui8xtgen
http://194.180.191.33/nui8xtgen
http://174.138.11.98/nui8xtgen
http://194.180.191.44/nui8xtgen
http://91.219.236.120/nui8xtgen
https://t.me/nui8xtgen

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1036 1704 WerFault.exe 066dd2538407a6ae20996556d4f67d50.exe

pid	pid_target	process	target process
1036	1704	WerFault.exe	066dd2538407a6ae20996556d4f67d50.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

066dd2538407a6ae20996556d4f67d50.exe

description	pid	process	target process
PID 1704 wrote to memory of 1036	1704	066dd2538407a6ae20996556d4f67d50.exe	WerFault.exe
PID 1704 wrote to memory of 1036	1704	066dd2538407a6ae20996556d4f67d50.exe	WerFault.exe
PID 1704 wrote to memory of 1036	1704	066dd2538407a6ae20996556d4f67d50.exe	WerFault.exe
PID 1704 wrote to memory of 1036	1704	066dd2538407a6ae20996556d4f67d50.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\066dd2538407a6ae20996556d4f67d50.exe
"C:\Users\Admin\AppData\Local\Temp\066dd2538407a6ae20996556d4f67d50.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 408
2⤵
- Program crash
PID:1036

memory/1704-54-0x000000000056F000-0x00000000005BF000-memory.dmp

Filesize
320KB

Download
memory/1704-55-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download
memory/1704-56-0x000000000056F000-0x00000000005BF000-memory.dmp

Filesize
320KB

Download
memory/1704-57-0x00000000002C0000-0x0000000000352000-memory.dmp

Filesize
584KB

Download
memory/1704-58-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download