raccoon | 952156fe6b02ba6087be739100138cf82bd4afbc0663212911a2307b8bdd0850

Analysis

max time kernel
90s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-02-2023 20:19

Target

file.exe
Size

637KB
MD5

eca4feba04eccc06945fbf8473b47fb6
SHA1

50de88877688aa47cbb51d775818e81cc0b2f5aa
SHA256

952156fe6b02ba6087be739100138cf82bd4afbc0663212911a2307b8bdd0850
SHA512

594b4d25928e62977a2ea26410b0376d1d86db91a1806f380565d7df936c7d291ee699f11f4fe08bf9fb5e50a37e91e48623276865f04cea8b010db140d21faa
SSDEEP

12288:2mbEKu7il2hsPb+HT0qE8S6S7ztLHKNu+A+/1bBc9xJPmH5x+dvs+0vLCX1mCwQx:2mbEKu6e8b8vOztLHKNu+A+/1bWFPBS0

Score

10^/10

Family

raccoon

Botnet

79baa49d7baf0a462ea77cc305c9dc65

http://78.47.92.58/

rc4.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 3440 set thread context of 816 3440 file.exe file.exe

description	pid	process	target process
PID 3440 set thread context of 816	3440	file.exe	file.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

file.exe

description	pid	process	target process
PID 3440 wrote to memory of 816	3440	file.exe	file.exe
PID 3440 wrote to memory of 816	3440	file.exe	file.exe
PID 3440 wrote to memory of 816	3440	file.exe	file.exe
PID 3440 wrote to memory of 816	3440	file.exe	file.exe
PID 3440 wrote to memory of 816	3440	file.exe	file.exe
PID 3440 wrote to memory of 816	3440	file.exe	file.exe
PID 3440 wrote to memory of 816	3440	file.exe	file.exe
PID 3440 wrote to memory of 816	3440	file.exe	file.exe

memory/816-137-0x0000000000000000-mapping.dmp

Download
memory/816-138-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/816-140-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/816-141-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/816-142-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3440-132-0x0000000000CE0000-0x0000000000D86000-memory.dmp

Filesize
664KB

Download
memory/3440-133-0x0000000005C00000-0x00000000061A4000-memory.dmp

Filesize
5.6MB

Download
memory/3440-134-0x0000000005650000-0x00000000056E2000-memory.dmp

Filesize
584KB

Download
memory/3440-135-0x00000000056F0000-0x000000000578C000-memory.dmp

Filesize
624KB

Download
memory/3440-136-0x00000000055D0000-0x00000000055DA000-memory.dmp

Filesize
40KB

Download