raccoon | 15f34133a747b4493e5a5ca3ac04a6bf9823bb5841884f5cab8ccf086c8ba13e

Analysis

max time kernel
48s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/10/2022, 10:10

Target
file.exe
Size 642KB
Sample221007-l7c8zscchr
SHA256 15f34133a747b4493e5a5ca3ac04a6bf9823bb5841884f5cab8ccf086c8ba13e
MD5 6ae344ac29d985c19cc49e5d0e040671
SHA1 e710e4b496f93fd3d5cba5f7121800a49d64465b
SHA512 7db3d44bce628a1328b1818916aa073d1104ce043c739efb51093a834e8ac013451632c37774ff767c3df5199989e8b0c4fc33c512ef81b80e5f89d1fd164944
SSDEEP 12288:MpF3rLb7M6IW5eubitv0+0OVemvY47KNVmYwUdZx0eM:MpF3ffbIWwGa0+0Ogm6qUx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

rc4.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 98528	1768	file.exe	28
PID 1768 wrote to memory of 98528	1768	file.exe	28
PID 1768 wrote to memory of 98528	1768	file.exe	28
PID 1768 wrote to memory of 98528	1768	file.exe	28
PID 1768 wrote to memory of 98528	1768	file.exe	28
PID 1768 wrote to memory of 98528	1768	file.exe	28
PID 1768 wrote to memory of 98528	1768	file.exe	28
PID 1768 wrote to memory of 98528	1768	file.exe	28

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:98528

memory/98528-54-0x0000000000090000-0x00000000000A4000-memory.dmp

Download

memory/98528-56-0x0000000000090000-0x00000000000A4000-memory.dmp

Download