raccoon | 11e141a28963aee412de2093c71e4941db6430afd84bebc1ec49364ca092a99e

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-01-2023 16:54

Target

11e141a28963aee412de2093c71e4941db6430afd84bebc1ec49364ca092a99e.dll
Size

1.2MB
MD5

6dacfc64e6770dfc1ea833b2794b4962
SHA1

5b09703165aabe10311b65520020226acf593155
SHA256

11e141a28963aee412de2093c71e4941db6430afd84bebc1ec49364ca092a99e
SHA512

c59a0301d0ca41835b840632f4eb1bf0b96c898a83d16691a77665fd80889fafaadb05684172daeaa8226393f07b382d71aaf9100b9dd874ae51a9c645b9f477
SSDEEP

24576:zmEsJqgac9liZYO7yDuQlKikjsZNn01z4F+WjWC40dOn:KPIg7ie/DuQYcNnCz4EW6C40Mn

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeIncBasePriorityPrivilege 1428 rundll32.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	1428	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1480 wrote to memory of 1428	1480	rundll32.exe	rundll32.exe
PID 1480 wrote to memory of 1428	1480	rundll32.exe	rundll32.exe
PID 1480 wrote to memory of 1428	1480	rundll32.exe	rundll32.exe
PID 1480 wrote to memory of 1428	1480	rundll32.exe	rundll32.exe
PID 1480 wrote to memory of 1428	1480	rundll32.exe	rundll32.exe
PID 1480 wrote to memory of 1428	1480	rundll32.exe	rundll32.exe
PID 1480 wrote to memory of 1428	1480	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11e141a28963aee412de2093c71e4941db6430afd84bebc1ec49364ca092a99e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1480

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11e141a28963aee412de2093c71e4941db6430afd84bebc1ec49364ca092a99e.dll,#1
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1428

memory/1428-54-0x0000000000000000-mapping.dmp

Download
memory/1428-55-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download
memory/1428-56-0x0000000010000000-0x000000001014C000-memory.dmp

Filesize
1.3MB

Download
memory/1428-57-0x0000000000940000-0x0000000000AE4000-memory.dmp

Filesize
1.6MB

Download
memory/1428-58-0x00000000001A0000-0x00000000001A4000-memory.dmp

Filesize
16KB

Download