raccoon | 8aa98f87e7d6ebc36689a7436795ec85a6b286e4c298ea82bc6f127ff98d0393

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18/10/2022, 06:37

Target

8aa98f87e7d6ebc36689a7436795ec85a6b286e4c298ea82bc6f127ff98d0393.exe
Size

214KB
MD5

36e4d1890a886e569b873e4385ae7833
SHA1

3764977cc90cb586131de0bb30921e131e6221e4
SHA256

8aa98f87e7d6ebc36689a7436795ec85a6b286e4c298ea82bc6f127ff98d0393
SHA512

e1e0d010c0724419f6e719dc03e4623be0a95fca232e7d4114b583a9794bc8d73b7f56e45a75555bff55a00dd33736b8329f5d82a3f0f08fd21a8806778f1ec9
SSDEEP

3072:3XpJF4LeFkAIZR6LGZ5AeuWbJWkp9cIiz3TjPRXPn0KNQ6:nWLeF7LGvJX7O3Tpn0qQ6

Score

10^/10

Family

raccoon

Botnet

63267bc2317b9849c2d512a4e16b0f3b

http://shettester1000.com/

rc4.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1460 set thread context of 880	1460	8aa98f87e7d6ebc36689a7436795ec85a6b286e4c298ea82bc6f127ff98d0393.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 880	1460	8aa98f87e7d6ebc36689a7436795ec85a6b286e4c298ea82bc6f127ff98d0393.exe	28
PID 1460 wrote to memory of 880	1460	8aa98f87e7d6ebc36689a7436795ec85a6b286e4c298ea82bc6f127ff98d0393.exe	28
PID 1460 wrote to memory of 880	1460	8aa98f87e7d6ebc36689a7436795ec85a6b286e4c298ea82bc6f127ff98d0393.exe	28
PID 1460 wrote to memory of 880	1460	8aa98f87e7d6ebc36689a7436795ec85a6b286e4c298ea82bc6f127ff98d0393.exe	28
PID 1460 wrote to memory of 880	1460	8aa98f87e7d6ebc36689a7436795ec85a6b286e4c298ea82bc6f127ff98d0393.exe	28
PID 1460 wrote to memory of 880	1460	8aa98f87e7d6ebc36689a7436795ec85a6b286e4c298ea82bc6f127ff98d0393.exe	28
PID 1460 wrote to memory of 880	1460	8aa98f87e7d6ebc36689a7436795ec85a6b286e4c298ea82bc6f127ff98d0393.exe	28
PID 1460 wrote to memory of 880	1460	8aa98f87e7d6ebc36689a7436795ec85a6b286e4c298ea82bc6f127ff98d0393.exe	28
PID 1460 wrote to memory of 880	1460	8aa98f87e7d6ebc36689a7436795ec85a6b286e4c298ea82bc6f127ff98d0393.exe	28
PID 1460 wrote to memory of 880	1460	8aa98f87e7d6ebc36689a7436795ec85a6b286e4c298ea82bc6f127ff98d0393.exe	28
PID 1460 wrote to memory of 880	1460	8aa98f87e7d6ebc36689a7436795ec85a6b286e4c298ea82bc6f127ff98d0393.exe	28

C:\Users\Admin\AppData\Local\Temp\8aa98f87e7d6ebc36689a7436795ec85a6b286e4c298ea82bc6f127ff98d0393.exe
"C:\Users\Admin\AppData\Local\Temp\8aa98f87e7d6ebc36689a7436795ec85a6b286e4c298ea82bc6f127ff98d0393.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Users\Admin\AppData\Local\Temp\8aa98f87e7d6ebc36689a7436795ec85a6b286e4c298ea82bc6f127ff98d0393.exe
  "C:\Users\Admin\AppData\Local\Temp\8aa98f87e7d6ebc36689a7436795ec85a6b286e4c298ea82bc6f127ff98d0393.exe"
  2⤵
  PID:880

memory/880-54-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/880-59-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/880-60-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/880-61-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1460-56-0x000000000064E000-0x000000000065E000-memory.dmp

Filesize
64KB

Download
memory/1460-58-0x0000000000220000-0x0000000000231000-memory.dmp

Filesize
68KB

Download