raccoon | f802517b302b7b494cf6748ec48ac12d8227aca3b6f0df352d3d8ff2833b7790 | Triage

Analysis

max time kernel
151s
max time network
192s
platform
windows7_x64
resource
win7-20220414-en
submitted
08-05-2022 06:21

Sharing

Report Analysis Logs

General

Target

f802517b302b7b494cf6748ec48ac12d8227aca3b6f0df352d3d8ff2833b7790.exe
Size

604KB
MD5

98ef6b207f05bf7755a8581ee62df858
SHA1

e22a6bfd6a88dee5701870a5fb1c9a518180d9b3
SHA256

f802517b302b7b494cf6748ec48ac12d8227aca3b6f0df352d3d8ff2833b7790
SHA512

ab619b901e78a4de29a7d4e612710887b41876a652d1e4e430d65b1409b7838579d4511175be2f46154d1ba6f63016670d01ec65bfd03139354d7b980288c01e

Score

10^/10

raccoon 159f4d1246023632a8a9d0760120348f475c4f6c stealer

Malware Config

Extracted

Family

raccoon

Botnet

159f4d1246023632a8a9d0760120348f475c4f6c

Attributes

url4cnc
https://telete.in/baudemars

rc4.plain

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1652-56-0x0000000000CF0000-0x0000000000D81000-memory.dmp	family_raccoon
behavioral1/memory/1652-57-0x0000000000400000-0x0000000000C72000-memory.dmp	family_raccoon

C:\Users\Admin\AppData\Local\Temp\f802517b302b7b494cf6748ec48ac12d8227aca3b6f0df352d3d8ff2833b7790.exe
"C:\Users\Admin\AppData\Local\Temp\f802517b302b7b494cf6748ec48ac12d8227aca3b6f0df352d3d8ff2833b7790.exe"
1⤵
PID:1652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1652-54-0x0000000075781000-0x0000000075783000-memory.dmp

Filesize
8KB

Download
memory/1652-55-0x00000000002CA000-0x000000000031A000-memory.dmp

Filesize
320KB

Download
memory/1652-56-0x0000000000CF0000-0x0000000000D81000-memory.dmp

Filesize
580KB

Download
memory/1652-57-0x0000000000400000-0x0000000000C72000-memory.dmp

Filesize
8.4MB

Download