Behavioral task
behavioral1
Sample
1976-54-0x0000000000EA0000-0x000000000194E000-memory.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
1976-54-0x0000000000EA0000-0x000000000194E000-memory.exe
Resource
win10v2004-20220722-en
General
-
Target
1976-54-0x0000000000EA0000-0x000000000194E000-memory.dmp
-
Size
10.7MB
-
MD5
99ab07056e47556ff50124171db5fbb6
-
SHA1
60a7f6ed89b79cbfa803bcf73031ec5e1ed7bb8f
-
SHA256
3674c4312183275869b82703d3aea8dba65310c76b7d95ffb49f798684918b9d
-
SHA512
baafcb22827796113baa37a392b6c5c8e42ec892676c01790f23187bcca39f2ad3eb542e2583fcc96fd79510eba721115121f8a87d0bc18d61f8482f278c4134
-
SSDEEP
196608:YaSeBfzYpco9spIW6VnDGE7jM5IvZ5w85heJ92bz30q/OQTWLkPergrrD6vZ6FzV:YaSeRCvWqWiCWjMQZCIhQ2Mq/OQK2DtP
Malware Config
Extracted
raccoon
839b5f035af17fe32dbee0ca113be5fc
http://89.185.85.53/
Signatures
-
Raccoon Stealer payload 1 IoCs
Processes:
resource yara_rule sample family_raccoon -
Raccoon family
Files
-
1976-54-0x0000000000EA0000-0x000000000194E000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
./n7 Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.F ` Size: 1024B - Virtual size: 872B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Rk. Size: 6.7MB - Virtual size: 6.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 161KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ