raccoon | 86e4b056bb87b626fe861f4de13fa31c4b3fb0ca648fe61a6d5587f9cd0ad9ec

Resubmissions

03-11-2022 21:39

max time kernel
151s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2022 21:39

Target

Setup.exe
Size

724.9MB
MD5

a34c0da1fcb5687b4f1da693f091d585
SHA1

c6fba65950d80f8447a0b483023fde2a77069f1c
SHA256

cbec5a09e5ab83b8f0233eebe71ec965f54ee62a51ff95044503429e6d304e46
SHA512

42c7ddb296be0fba16d0167b086e8e89eafbde7c4a30c0fa5a55b9d9c2a37e6cc77854885cb090d8ee62cddfe4d2c478715a151ecfb3165d5fb832706a388ee9
SSDEEP

24576:eNcG3DmVrbWv+6wV/+m9zsZ/rTZ3rpLe1V13rpeBxLlMkLQq5a93wtTt52lqNz:eNcGpJj2lqJ

Score

10^/10

Family

raccoon

Botnet

55141fdba30e9c28fe0ae2e082b22897

http://45.15.156.72/

rc4.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description pid process target process

PID 952 set thread context of 1756 952 Setup.exe csc.exe

description	pid	process	target process
PID 952 set thread context of 1756	952	Setup.exe	csc.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Setup.exe

description	pid	process	target process
PID 952 wrote to memory of 1756	952	Setup.exe	csc.exe
PID 952 wrote to memory of 1756	952	Setup.exe	csc.exe
PID 952 wrote to memory of 1756	952	Setup.exe	csc.exe
PID 952 wrote to memory of 1756	952	Setup.exe	csc.exe
PID 952 wrote to memory of 1756	952	Setup.exe	csc.exe
PID 952 wrote to memory of 1756	952	Setup.exe	csc.exe
PID 952 wrote to memory of 1756	952	Setup.exe	csc.exe
PID 952 wrote to memory of 1756	952	Setup.exe	csc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
2⤵
PID:1756

memory/952-132-0x0000000000010000-0x0000000000150000-memory.dmp

Filesize
1.2MB

Download
memory/952-133-0x0000000004940000-0x00000000049A6000-memory.dmp

Filesize
408KB

Download
memory/1756-134-0x0000000000000000-mapping.dmp

Download
memory/1756-135-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1756-137-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1756-138-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download