raccoon | 952156fe6b02ba6087be739100138cf82bd4afbc0663212911a2307b8bdd0850

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-02-2023 20:20

Target

file.exe
Size

637KB
MD5

eca4feba04eccc06945fbf8473b47fb6
SHA1

50de88877688aa47cbb51d775818e81cc0b2f5aa
SHA256

952156fe6b02ba6087be739100138cf82bd4afbc0663212911a2307b8bdd0850
SHA512

594b4d25928e62977a2ea26410b0376d1d86db91a1806f380565d7df936c7d291ee699f11f4fe08bf9fb5e50a37e91e48623276865f04cea8b010db140d21faa
SSDEEP

12288:2mbEKu7il2hsPb+HT0qE8S6S7ztLHKNu+A+/1bBc9xJPmH5x+dvs+0vLCX1mCwQx:2mbEKu6e8b8vOztLHKNu+A+/1bWFPBS0

Score

10^/10

Family

raccoon

Botnet

79baa49d7baf0a462ea77cc305c9dc65

http://78.47.92.58/

rc4.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 1884 set thread context of 1168 1884 file.exe file.exe

description	pid	process	target process
PID 1884 set thread context of 1168	1884	file.exe	file.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

file.exe

description	pid	process	target process
PID 1884 wrote to memory of 1168	1884	file.exe	file.exe
PID 1884 wrote to memory of 1168	1884	file.exe	file.exe
PID 1884 wrote to memory of 1168	1884	file.exe	file.exe
PID 1884 wrote to memory of 1168	1884	file.exe	file.exe
PID 1884 wrote to memory of 1168	1884	file.exe	file.exe
PID 1884 wrote to memory of 1168	1884	file.exe	file.exe
PID 1884 wrote to memory of 1168	1884	file.exe	file.exe
PID 1884 wrote to memory of 1168	1884	file.exe	file.exe
PID 1884 wrote to memory of 1168	1884	file.exe	file.exe

memory/1168-59-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1168-60-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1168-62-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1168-64-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1168-65-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1168-66-0x00000000004088ED-mapping.dmp

Download
memory/1884-54-0x00000000002E0000-0x0000000000386000-memory.dmp

Filesize
664KB

Download
memory/1884-55-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/1884-56-0x00000000002B0000-0x00000000002BE000-memory.dmp

Filesize
56KB

Download
memory/1884-57-0x0000000004240000-0x00000000042B0000-memory.dmp

Filesize
448KB

Download
memory/1884-58-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download