raccoon | 7089ad447bc518385d3858e983df63e7cb011e518beb4ed4117d7496a5fd28b1

Analysis

max time kernel
75s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-02-2023 10:19

Target

a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe
Size

830KB
MD5

bc46af138f661c31bd23dfed643aec0c
SHA1

db363d46dfb756f97c7cfb3b0be91d1af5200a6b
SHA256

a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828
SHA512

5c6171875162886b678daa1d4096b3c3ef0bc60fb83f7528c31eaa73c2def7adf4adb51cd858223690e9b684dce446811132bb8bfee5db78a478c77cc0b003c3
SSDEEP

24576:K2zMwwTlE32rV9AFLVGpMo5c+idrNtNNx8qR1g:3wTlOEsMK8c9dd4

Score

10^/10

Family

raccoon

Botnet

cabcf15ea37a24b58186813d42a6971f

http://83.217.11.16/

rc4.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Suspicious use of SetThreadContext 1 IoCs

Processes:

a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe

description	pid	process	target process
PID 4588 set thread context of 4740	4588	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe

description	pid	process	target process
PID 4588 wrote to memory of 4740	4588	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe
PID 4588 wrote to memory of 4740	4588	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe
PID 4588 wrote to memory of 4740	4588	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe
PID 4588 wrote to memory of 4740	4588	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe
PID 4588 wrote to memory of 4740	4588	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe
PID 4588 wrote to memory of 4740	4588	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe
PID 4588 wrote to memory of 4740	4588	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe
PID 4588 wrote to memory of 4740	4588	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe	a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe

C:\Users\Admin\AppData\Local\Temp\a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe
"C:\Users\Admin\AppData\Local\Temp\a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828.exe"
2⤵
PID:4740

memory/4588-132-0x0000000000D30000-0x0000000000E04000-memory.dmp

Filesize
848KB

Download
memory/4588-133-0x0000000005E80000-0x0000000006424000-memory.dmp

Filesize
5.6MB

Download
memory/4588-134-0x00000000057C0000-0x0000000005852000-memory.dmp

Filesize
584KB

Download
memory/4588-135-0x00000000057B0000-0x00000000057BA000-memory.dmp

Filesize
40KB

Download
memory/4588-136-0x0000000005B70000-0x0000000005C0C000-memory.dmp

Filesize
624KB

Download
memory/4740-137-0x0000000000000000-mapping.dmp

Download
memory/4740-138-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4740-140-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4740-141-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download