raccoon | 199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 02:16

Target

199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168.exe
Size

594KB
MD5

811f64ea53b76f4e63f3baa9cbf449af
SHA1

bdbb1cb65db56922bdab468e47a4b4ecfad9bc13
SHA256

199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168
SHA512

3f0f7ba95068b56bb604e564c01ea6bb3b0dcd6a10d437301467a56b823a7e7c040ed16ed989bd444239fee2265248f264a86d1a1a7c9f610666679c3f99caa1
SSDEEP

12288:+wbZEYGhNrkgCpLQX1/5kdPHT2/OdMuuTCUdsmGNN3vSkiLEOPtttbpXbqYr0IB/:lAkbp8

Score

10^/10

Family

raccoon

Botnet

16465d0e7bfd19684d4e56a43306c91b

http://79.137.196.11/

rc4.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Suspicious use of SetThreadContext 1 IoCs

Processes:

199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168.exe

description	pid	process	target process
PID 4004 set thread context of 4916	4004	199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168.exe	199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168.exe

description pid process

Token: SeDebugPrivilege 4004 199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168.exe

description	pid	process
Token: SeDebugPrivilege	4004	199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168.exe

description	pid	process	target process
PID 4004 wrote to memory of 4916	4004	199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168.exe	199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168.exe
PID 4004 wrote to memory of 4916	4004	199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168.exe	199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168.exe
PID 4004 wrote to memory of 4916	4004	199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168.exe	199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168.exe
PID 4004 wrote to memory of 4916	4004	199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168.exe	199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168.exe
PID 4004 wrote to memory of 4916	4004	199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168.exe	199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168.exe
PID 4004 wrote to memory of 4916	4004	199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168.exe	199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168.exe
PID 4004 wrote to memory of 4916	4004	199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168.exe	199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168.exe
PID 4004 wrote to memory of 4916	4004	199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168.exe	199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168.exe

C:\Users\Admin\AppData\Local\Temp\199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168.exe
"C:\Users\Admin\AppData\Local\Temp\199a20b72c4eb70450a036e25f8abc1eae9b0ba5ab269651d25480b909ac6168.exe"
2⤵
PID:4916

memory/4004-132-0x0000000000E20000-0x0000000000EBE000-memory.dmp

Filesize
632KB

Download
memory/4004-133-0x0000000005EE0000-0x0000000006484000-memory.dmp

Filesize
5.6MB

Download
memory/4004-134-0x0000000005930000-0x00000000059CC000-memory.dmp

Filesize
624KB

Download
memory/4916-135-0x0000000000000000-mapping.dmp

Download
memory/4916-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4916-138-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4916-139-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download