raccoon | 9492642ad34ae6774b07ed2f5835ca95d2b4d555bb17afa090de9cd5965cb41d

Analysis

max time kernel
85s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2023 17:21

Target

Setup.exe
Size

464.2MB
MD5

b7acc6f593be4c46139172e407cd8a31
SHA1

c5da8ad87b48c9fb91737adcecb96c2b8f080d3f
SHA256

51f5d6c6f04596d1911c8b8c400b4c358f31c24f68e15a88b92532d96350f2b2
SHA512

0462ad8c7da7bad9b9a6e4c1814b12f78c7b927fe29265ef4ae5f7569930aebbe683bad6b206fcea2591b3d37031cf67cef64bdeb5de90edcf92c2caa3894827
SSDEEP

24576:0H/uo6PLM7WzcR9IMfmBm8Cvbgu7hkLXsZyJp:a104RjOt8A86

Score

10^/10

Family

raccoon

Botnet

697fc5d9af6aa2a29510779d2fc54b97

http://83.217.11.27/

http://83.217.11.28/

rc4.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description pid process target process

PID 2688 set thread context of 408 2688 Setup.exe Setup.exe

description	pid	process	target process
PID 2688 set thread context of 408	2688	Setup.exe	Setup.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Setup.exe

description	pid	process	target process
PID 2688 wrote to memory of 408	2688	Setup.exe	Setup.exe
PID 2688 wrote to memory of 408	2688	Setup.exe	Setup.exe
PID 2688 wrote to memory of 408	2688	Setup.exe	Setup.exe
PID 2688 wrote to memory of 408	2688	Setup.exe	Setup.exe
PID 2688 wrote to memory of 408	2688	Setup.exe	Setup.exe
PID 2688 wrote to memory of 408	2688	Setup.exe	Setup.exe
PID 2688 wrote to memory of 408	2688	Setup.exe	Setup.exe
PID 2688 wrote to memory of 408	2688	Setup.exe	Setup.exe

memory/408-137-0x0000000000000000-mapping.dmp

Download
memory/408-138-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/408-140-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/408-141-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2688-132-0x00000000009E0000-0x0000000000B02000-memory.dmp

Filesize
1.1MB

Download
memory/2688-133-0x0000000005880000-0x0000000005E24000-memory.dmp

Filesize
5.6MB

Download
memory/2688-134-0x0000000005370000-0x0000000005402000-memory.dmp

Filesize
584KB

Download
memory/2688-135-0x00000000054B0000-0x000000000554C000-memory.dmp

Filesize
624KB

Download
memory/2688-136-0x0000000005360000-0x000000000536A000-memory.dmp

Filesize
40KB

Download