raccoon | 24de09bb454b0318af20ffcc21c6dd4ad5d6627cab7d7bfcb5c2278f63a2c3b7

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30-01-2023 16:54

Target

24de09bb454b0318af20ffcc21c6dd4ad5d6627cab7d7bfcb5c2278f63a2c3b7.dll
Size

1.6MB
MD5

7c8f35ee73984b669e2eea85264a3aae
SHA1

0a847ff88aef14749d5c7d697da5d9264a383ef7
SHA256

24de09bb454b0318af20ffcc21c6dd4ad5d6627cab7d7bfcb5c2278f63a2c3b7
SHA512

4f1636b7a0a0fb340ebbd2e42b42faa7c9ebc9a290c7fd93bf3adbac725201173d6f6543c1a36d28319ef272f88066534c109b28a34480d6ce6106e6ef2af8d1
SSDEEP

24576:A5Ki2AD4LrI6Q67uvtY9mvnPiXsr8ZGK+fxJzBraI5MGgQddfZ/4rS8+d:A5K9AMXI6H7uvtYYiGgigI5MoB/sSPd

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1184 wrote to memory of 1220	1184	rundll32.exe	rundll32.exe
PID 1184 wrote to memory of 1220	1184	rundll32.exe	rundll32.exe
PID 1184 wrote to memory of 1220	1184	rundll32.exe	rundll32.exe
PID 1184 wrote to memory of 1220	1184	rundll32.exe	rundll32.exe
PID 1184 wrote to memory of 1220	1184	rundll32.exe	rundll32.exe
PID 1184 wrote to memory of 1220	1184	rundll32.exe	rundll32.exe
PID 1184 wrote to memory of 1220	1184	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24de09bb454b0318af20ffcc21c6dd4ad5d6627cab7d7bfcb5c2278f63a2c3b7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1184

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24de09bb454b0318af20ffcc21c6dd4ad5d6627cab7d7bfcb5c2278f63a2c3b7.dll,#1
2⤵
PID:1220

memory/1220-54-0x0000000000000000-mapping.dmp

Download
memory/1220-55-0x00000000767F1000-0x00000000767F3000-memory.dmp

Filesize
8KB

Download
memory/1220-56-0x0000000010000000-0x00000000101C3000-memory.dmp

Filesize
1.8MB

Download
memory/1220-57-0x0000000000920000-0x0000000000A91000-memory.dmp

Filesize
1.4MB

Download
memory/1220-58-0x0000000000120000-0x0000000000124000-memory.dmp

Filesize
16KB

Download
memory/1220-59-0x0000000000920000-0x0000000000A91000-memory.dmp

Filesize
1.4MB

Download