raccoon | e9f10c8c32952054ffb16dc8dc128c724a8a94d6368b572eb590be9e301933bc | Triage

Analysis

max time kernel
150s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20-05-2022 14:35

Sharing

Report Analysis Logs

General

Target

Payment_copyUSD_pdf.exe
Size

443KB
MD5

63318f287f84a300750a2236901f357e
SHA1

bc98b692a27350b81694288783b17647739917d9
SHA256

13b574bdacbd66335eb90d98e9be0e0bbd36373658a41c691d25b1d39c3621e4
SHA512

f993591ddec78cd4da277e44333fcf5a8b24c13123c81bbc07d3240320262ed1d15839227c69b5a2af9e72dd848918a34d5735dd9fd11bc86c9a2ae833ab55ae

Score

10^/10

raccoon e29019d302d3c4858d02133aa50d6f91fdba32ce stealer

Malware Config

Extracted

Family

raccoon

Botnet

e29019d302d3c4858d02133aa50d6f91fdba32ce

Attributes

url4cnc
https://telete.in/h_dmartens_1

rc4.plain

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3040-131-0x0000000000D60000-0x0000000000DF0000-memory.dmp	family_raccoon
behavioral2/memory/3040-132-0x0000000000400000-0x0000000000C8E000-memory.dmp	family_raccoon

C:\Users\Admin\AppData\Local\Temp\Payment_copyUSD_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Payment_copyUSD_pdf.exe"
1⤵
PID:3040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3040-130-0x0000000000E83000-0x0000000000ED3000-memory.dmp

Filesize
320KB

Download
memory/3040-131-0x0000000000D60000-0x0000000000DF0000-memory.dmp

Filesize
576KB

Download
memory/3040-132-0x0000000000400000-0x0000000000C8E000-memory.dmp

Filesize
8.6MB

Download