raccoon | f475056480a797aa29c860f3141ae41f0fa2d477e6c036c7a3b63cf6e4e589ad

Analysis

max time kernel
23s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
31-01-2023 07:14

Target

setupsoftapp19.0.exe
Size

762.9MB
MD5

17aaa592f0b1bd973f5f66a4dfa728dc
SHA1

31f91c8e2349ebd94ab4170f856d7ca6b65b4143
SHA256

e96809c130f1387f78a72e0ad4280a13aa10223aaacb3388cf3e8971e2b14c86
SHA512

565c4dff550206ffac85e9e9482b00d8859c79208889b9bd7741530d218c18576b41a5fbba08513595e3ae9bb351d66a775fa99c0cc2522af7551af2e1fe0a32
SSDEEP

98304:SIAzUE2bRCunvAdP4lLBYHHm/+MJXzdG7cLwE0xYhrRx4S/HzL71hY:SIKU4uodQjAUJxG7c0EIYJ/4S/TL70

Score

10^/10

Family

raccoon

Botnet

3f4a8564e5026a245d6974b020b3f6de

http://45.15.156.225/

rc4.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious use of SetThreadContext 1 IoCs

Processes:

setupsoftapp19.0.exe

description pid process target process

PID 2020 set thread context of 1056 2020 setupsoftapp19.0.exe InstallUtil.exe

description	pid	process	target process
PID 2020 set thread context of 1056	2020	setupsoftapp19.0.exe	InstallUtil.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

setupsoftapp19.0.exe

description	pid	process	target process
PID 2020 wrote to memory of 1056	2020	setupsoftapp19.0.exe	InstallUtil.exe
PID 2020 wrote to memory of 1056	2020	setupsoftapp19.0.exe	InstallUtil.exe
PID 2020 wrote to memory of 1056	2020	setupsoftapp19.0.exe	InstallUtil.exe
PID 2020 wrote to memory of 1056	2020	setupsoftapp19.0.exe	InstallUtil.exe
PID 2020 wrote to memory of 1056	2020	setupsoftapp19.0.exe	InstallUtil.exe
PID 2020 wrote to memory of 1056	2020	setupsoftapp19.0.exe	InstallUtil.exe
PID 2020 wrote to memory of 1056	2020	setupsoftapp19.0.exe	InstallUtil.exe
PID 2020 wrote to memory of 1056	2020	setupsoftapp19.0.exe	InstallUtil.exe
PID 2020 wrote to memory of 1056	2020	setupsoftapp19.0.exe	InstallUtil.exe
PID 2020 wrote to memory of 1056	2020	setupsoftapp19.0.exe	InstallUtil.exe
PID 2020 wrote to memory of 1056	2020	setupsoftapp19.0.exe	InstallUtil.exe
PID 2020 wrote to memory of 1056	2020	setupsoftapp19.0.exe	InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe"
2⤵
PID:1056

memory/1056-56-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1056-57-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1056-59-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1056-61-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1056-62-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1056-63-0x00000000004088ED-mapping.dmp

Download
memory/2020-54-0x0000000000A50000-0x0000000001962000-memory.dmp

Filesize
15.1MB

Download
memory/2020-55-0x000000001C550000-0x000000001C7AE000-memory.dmp

Filesize
2.4MB

Download