raccoon | 51f5d6c6f04596d1911c8b8c400b4c358f31c24f68e15a88b92532d96350f2b2

Analysis

max time kernel
36s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-02-2023 20:48

Target

Setup.exe
Size

464.2MB
MD5

b7acc6f593be4c46139172e407cd8a31
SHA1

c5da8ad87b48c9fb91737adcecb96c2b8f080d3f
SHA256

51f5d6c6f04596d1911c8b8c400b4c358f31c24f68e15a88b92532d96350f2b2
SHA512

0462ad8c7da7bad9b9a6e4c1814b12f78c7b927fe29265ef4ae5f7569930aebbe683bad6b206fcea2591b3d37031cf67cef64bdeb5de90edcf92c2caa3894827
SSDEEP

24576:0H/uo6PLM7WzcR9IMfmBm8Cvbgu7hkLXsZyJp:a104RjOt8A86

Score

10^/10

Family

raccoon

Botnet

697fc5d9af6aa2a29510779d2fc54b97

http://83.217.11.27/

http://83.217.11.28/

rc4.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description pid process target process

PID 1472 set thread context of 1760 1472 Setup.exe Setup.exe

description	pid	process	target process
PID 1472 set thread context of 1760	1472	Setup.exe	Setup.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Setup.exe

description	pid	process	target process
PID 1472 wrote to memory of 1760	1472	Setup.exe	Setup.exe
PID 1472 wrote to memory of 1760	1472	Setup.exe	Setup.exe
PID 1472 wrote to memory of 1760	1472	Setup.exe	Setup.exe
PID 1472 wrote to memory of 1760	1472	Setup.exe	Setup.exe
PID 1472 wrote to memory of 1760	1472	Setup.exe	Setup.exe
PID 1472 wrote to memory of 1760	1472	Setup.exe	Setup.exe
PID 1472 wrote to memory of 1760	1472	Setup.exe	Setup.exe
PID 1472 wrote to memory of 1760	1472	Setup.exe	Setup.exe
PID 1472 wrote to memory of 1760	1472	Setup.exe	Setup.exe
PID 1472 wrote to memory of 1760	1472	Setup.exe	Setup.exe
PID 1472 wrote to memory of 1760	1472	Setup.exe	Setup.exe
PID 1472 wrote to memory of 1760	1472	Setup.exe	Setup.exe

memory/1472-54-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/1472-55-0x00000000000C0000-0x00000000001E2000-memory.dmp

Filesize
1.1MB

Download
memory/1472-56-0x0000000000540000-0x000000000054E000-memory.dmp

Filesize
56KB

Download
memory/1472-57-0x0000000005580000-0x00000000055F0000-memory.dmp

Filesize
448KB

Download
memory/1472-58-0x00000000007B0000-0x00000000007D0000-memory.dmp

Filesize
128KB

Download
memory/1760-59-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1760-60-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1760-62-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1760-64-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1760-65-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1760-66-0x00000000004088ED-mapping.dmp

Download