raccoon | b94872e1a7599af25caa25013fc0054e5affda6cfaef65338aa344ca2b21b4db

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08-02-2023 18:36

Target

B94872E1A7599AF25CAA25013FC0054E5AFFDA6CFAEF6.dll
Size

2.0MB
MD5

4979beaa139791aa9d265ddc00fff0c6
SHA1

22301285c8a3e4fc0d8086f23265a2b5e7552544
SHA256

b94872e1a7599af25caa25013fc0054e5affda6cfaef65338aa344ca2b21b4db
SHA512

43267b709819f47d225013475450b879770f7e8b636be602e54bc83f57189218348027d75e0695cbb0027447ef3cacd7fb2efcc82a2f036f871e3b44c84d3341
SSDEEP

24576:Or+mhOVsJou/n4JX293Q9vGvvrIs91cYZfT4xvIwDC4k+:BmhOsouP439v6Pc+fTYO4/

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeIncBasePriorityPrivilege 3976 rundll32.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	3976	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4648 wrote to memory of 3976	4648	rundll32.exe	rundll32.exe
PID 4648 wrote to memory of 3976	4648	rundll32.exe	rundll32.exe
PID 4648 wrote to memory of 3976	4648	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\B94872E1A7599AF25CAA25013FC0054E5AFFDA6CFAEF6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4648

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\B94872E1A7599AF25CAA25013FC0054E5AFFDA6CFAEF6.dll,#1
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3976

memory/3976-132-0x0000000000000000-mapping.dmp

Download
memory/3976-133-0x0000000010000000-0x000000001013E000-memory.dmp

Filesize
1.2MB

Download
memory/3976-134-0x0000000002040000-0x00000000021C8000-memory.dmp

Filesize
1.5MB

Download
memory/3976-135-0x00000000005E0000-0x00000000005E4000-memory.dmp

Filesize
16KB

Download
memory/3976-136-0x0000000002040000-0x00000000021C8000-memory.dmp

Filesize
1.5MB

Download