raccoon | 30ec00ba50d99d977ffd77690d3e1b89afa7c4aed1ad64da01d0d29820cbae89

Analysis

max time kernel
151s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 18:01

Target
Setup.exe
Size 619.9MB
Sample221206-wlwhjsah59
SHA256 4375161dc854a880060138b3f1d53cb2f34dcb8c39dec5d360d495c19e37ee6a
MD5 97a900bf04998af24e6d1666815672fb
SHA1 0c0715be2efbd212caccd81e394d9e0d4cd9deb9
SHA512 f32baa1452aeb3ced21920fa79c9963c20445f282ea6c8b4e11e0a946262eb624156646006655e8a57d743814088ca3b5904d0c72e4995d5861ab8442f8d1307
SSDEEP 196608:JUsap9XiMqRvC/A8OcYXhUHSnqLmPl4qBwRhYXCR9iL23TQq:JbKK2rZiFlnBwxTQq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

rc4.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3312 set thread context of 4596	3312	Setup.exe	80

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3312	Setup.exe
3312	Setup.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3312	Setup.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 3376	3312	Setup.exe	79
PID 3312 wrote to memory of 3376	3312	Setup.exe	79
PID 3312 wrote to memory of 3376	3312	Setup.exe	79
PID 3312 wrote to memory of 4596	3312	Setup.exe	80
PID 3312 wrote to memory of 4596	3312	Setup.exe	80
PID 3312 wrote to memory of 4596	3312	Setup.exe	80
PID 3312 wrote to memory of 4596	3312	Setup.exe	80
PID 3312 wrote to memory of 4596	3312	Setup.exe	80
PID 3312 wrote to memory of 4596	3312	Setup.exe	80
PID 3312 wrote to memory of 4596	3312	Setup.exe	80
PID 3312 wrote to memory of 4596	3312	Setup.exe	80

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:3376
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:4596

memory/3312-132-0x0000000000730000-0x00000000013D0000-memory.dmp

Download

memory/3312-133-0x00007FFE810B0000-0x00007FFE81B71000-memory.dmp

Download

memory/3312-138-0x00007FFE810B0000-0x00007FFE81B71000-memory.dmp

Download

memory/3312-140-0x00007FFE810B0000-0x00007FFE81B71000-memory.dmp

Download

memory/4596-134-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4596-137-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4596-139-0x0000000000400000-0x0000000000412000-memory.dmp

Download