raccoon | 86e4b056bb87b626fe861f4de13fa31c4b3fb0ca648fe61a6d5587f9cd0ad9ec

Resubmissions

03-11-2022 21:39

max time kernel
40s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-11-2022 21:39

Target

Setup.exe
Size

724.9MB
MD5

a34c0da1fcb5687b4f1da693f091d585
SHA1

c6fba65950d80f8447a0b483023fde2a77069f1c
SHA256

cbec5a09e5ab83b8f0233eebe71ec965f54ee62a51ff95044503429e6d304e46
SHA512

42c7ddb296be0fba16d0167b086e8e89eafbde7c4a30c0fa5a55b9d9c2a37e6cc77854885cb090d8ee62cddfe4d2c478715a151ecfb3165d5fb832706a388ee9
SSDEEP

24576:eNcG3DmVrbWv+6wV/+m9zsZ/rTZ3rpLe1V13rpeBxLlMkLQq5a93wtTt52lqNz:eNcGpJj2lqJ

Score

10^/10

Family

raccoon

Botnet

55141fdba30e9c28fe0ae2e082b22897

http://45.15.156.72/

rc4.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description pid process target process

PID 1116 set thread context of 956 1116 Setup.exe csc.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Setup.exe

pid process

1116 Setup.exe
1116 Setup.exe
1116 Setup.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Setup.exe

description pid process

Token: SeDebugPrivilege 1116 Setup.exe

description	pid	process	target process
PID 1116 set thread context of 956	1116	Setup.exe	csc.exe

description	pid	process
Token: SeDebugPrivilege	1116	Setup.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

Setup.exe

description	pid	process	target process
PID 1116 wrote to memory of 1264	1116	Setup.exe	csc.exe
PID 1116 wrote to memory of 1264	1116	Setup.exe	csc.exe
PID 1116 wrote to memory of 1264	1116	Setup.exe	csc.exe
PID 1116 wrote to memory of 1264	1116	Setup.exe	csc.exe
PID 1116 wrote to memory of 1732	1116	Setup.exe	csc.exe
PID 1116 wrote to memory of 1732	1116	Setup.exe	csc.exe
PID 1116 wrote to memory of 1732	1116	Setup.exe	csc.exe
PID 1116 wrote to memory of 1732	1116	Setup.exe	csc.exe
PID 1116 wrote to memory of 1372	1116	Setup.exe	csc.exe
PID 1116 wrote to memory of 1372	1116	Setup.exe	csc.exe
PID 1116 wrote to memory of 1372	1116	Setup.exe	csc.exe
PID 1116 wrote to memory of 1372	1116	Setup.exe	csc.exe
PID 1116 wrote to memory of 956	1116	Setup.exe	csc.exe
PID 1116 wrote to memory of 956	1116	Setup.exe	csc.exe
PID 1116 wrote to memory of 956	1116	Setup.exe	csc.exe
PID 1116 wrote to memory of 956	1116	Setup.exe	csc.exe
PID 1116 wrote to memory of 956	1116	Setup.exe	csc.exe
PID 1116 wrote to memory of 956	1116	Setup.exe	csc.exe
PID 1116 wrote to memory of 956	1116	Setup.exe	csc.exe
PID 1116 wrote to memory of 956	1116	Setup.exe	csc.exe
PID 1116 wrote to memory of 956	1116	Setup.exe	csc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
2⤵
PID:1264

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
2⤵
PID:1732

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
2⤵
PID:1372

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
2⤵
PID:956

memory/956-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/956-57-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/956-59-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/956-61-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/956-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/956-63-0x00000000004088B5-mapping.dmp

Download
memory/956-65-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/956-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1116-54-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download
memory/1116-55-0x0000000000340000-0x0000000000480000-memory.dmp

Filesize
1.2MB

Download