raccoon | a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828

Analysis

max time kernel
80s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2023 20:16

Target

bc46af138f661c31bd23dfed643aec0c.exe
Size

830KB
MD5

bc46af138f661c31bd23dfed643aec0c
SHA1

db363d46dfb756f97c7cfb3b0be91d1af5200a6b
SHA256

a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828
SHA512

5c6171875162886b678daa1d4096b3c3ef0bc60fb83f7528c31eaa73c2def7adf4adb51cd858223690e9b684dce446811132bb8bfee5db78a478c77cc0b003c3
SSDEEP

24576:K2zMwwTlE32rV9AFLVGpMo5c+idrNtNNx8qR1g:3wTlOEsMK8c9dd4

Score

10^/10

Family

raccoon

Botnet

cabcf15ea37a24b58186813d42a6971f

http://83.217.11.16/

rc4.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious use of SetThreadContext 1 IoCs

Processes:

bc46af138f661c31bd23dfed643aec0c.exe

description pid process target process

PID 2148 set thread context of 3696 2148 bc46af138f661c31bd23dfed643aec0c.exe bc46af138f661c31bd23dfed643aec0c.exe

description	pid	process	target process
PID 2148 set thread context of 3696	2148	bc46af138f661c31bd23dfed643aec0c.exe	bc46af138f661c31bd23dfed643aec0c.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

bc46af138f661c31bd23dfed643aec0c.exe

description	pid	process	target process
PID 2148 wrote to memory of 3696	2148	bc46af138f661c31bd23dfed643aec0c.exe	bc46af138f661c31bd23dfed643aec0c.exe
PID 2148 wrote to memory of 3696	2148	bc46af138f661c31bd23dfed643aec0c.exe	bc46af138f661c31bd23dfed643aec0c.exe
PID 2148 wrote to memory of 3696	2148	bc46af138f661c31bd23dfed643aec0c.exe	bc46af138f661c31bd23dfed643aec0c.exe
PID 2148 wrote to memory of 3696	2148	bc46af138f661c31bd23dfed643aec0c.exe	bc46af138f661c31bd23dfed643aec0c.exe
PID 2148 wrote to memory of 3696	2148	bc46af138f661c31bd23dfed643aec0c.exe	bc46af138f661c31bd23dfed643aec0c.exe
PID 2148 wrote to memory of 3696	2148	bc46af138f661c31bd23dfed643aec0c.exe	bc46af138f661c31bd23dfed643aec0c.exe
PID 2148 wrote to memory of 3696	2148	bc46af138f661c31bd23dfed643aec0c.exe	bc46af138f661c31bd23dfed643aec0c.exe
PID 2148 wrote to memory of 3696	2148	bc46af138f661c31bd23dfed643aec0c.exe	bc46af138f661c31bd23dfed643aec0c.exe

C:\Users\Admin\AppData\Local\Temp\bc46af138f661c31bd23dfed643aec0c.exe
"C:\Users\Admin\AppData\Local\Temp\bc46af138f661c31bd23dfed643aec0c.exe"
2⤵
PID:3696

memory/2148-132-0x00000000002F0000-0x00000000003C4000-memory.dmp

Filesize
848KB

Download
memory/2148-133-0x0000000005420000-0x00000000059C4000-memory.dmp

Filesize
5.6MB

Download
memory/2148-134-0x0000000004D60000-0x0000000004DF2000-memory.dmp

Filesize
584KB

Download
memory/2148-135-0x0000000004E20000-0x0000000004E2A000-memory.dmp

Filesize
40KB

Download
memory/2148-136-0x0000000005070000-0x000000000510C000-memory.dmp

Filesize
624KB

Download
memory/3696-137-0x0000000000000000-mapping.dmp

Download
memory/3696-138-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3696-140-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3696-141-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3696-142-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download