raccoon | f2551d6506bebf6a9522f1fef7764f483214f8baee5595957dc80472f0b43b05 | Triage

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
15-05-2022 21:50

Sharing

Report Analysis Logs

General

Target

f2551d6506bebf6a9522f1fef7764f483214f8baee5595957dc80472f0b43b05.exe
Size

482KB
MD5

82c49dd2427383d22d1e836e2adfd266
SHA1

9800e2b9e792e3f75aa34b65ba9a1f47b4371862
SHA256

f2551d6506bebf6a9522f1fef7764f483214f8baee5595957dc80472f0b43b05
SHA512

667832b086a226e09fce07d8c24cdff287a88821a7b026490ba27db5db1f90f3aa3af7d97ad76fb6ddd707fa294373c75366ae55ecaa3a8325f72af3fca4912a

Score

10^/10

raccoon ef5c4ae6eecb3be16c1e2f8bfa015718d26593aa stealer

Malware Config

Extracted

Family

raccoon

Botnet

ef5c4ae6eecb3be16c1e2f8bfa015718d26593aa

Attributes

url4cnc
https://telete.in/jdiamond13

rc4.plain

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4980-131-0x0000000000B30000-0x0000000000BC0000-memory.dmp	family_raccoon
behavioral2/memory/4980-132-0x0000000000400000-0x00000000009C9000-memory.dmp	family_raccoon

C:\Users\Admin\AppData\Local\Temp\f2551d6506bebf6a9522f1fef7764f483214f8baee5595957dc80472f0b43b05.exe
"C:\Users\Admin\AppData\Local\Temp\f2551d6506bebf6a9522f1fef7764f483214f8baee5595957dc80472f0b43b05.exe"
1⤵
PID:4980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4980-130-0x0000000000C19000-0x0000000000C69000-memory.dmp

Filesize
320KB

Download
memory/4980-131-0x0000000000B30000-0x0000000000BC0000-memory.dmp

Filesize
576KB

Download
memory/4980-132-0x0000000000400000-0x00000000009C9000-memory.dmp

Filesize
5.8MB

Download