raccoon | b297a76de5182907a69a878cf161ca65b274152eb92a9d9591248ac4f5494dcf

Resubmissions

20-02-2023 05:44

max time kernel
99s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2023 05:44

Target

Setup.exe
Size

438.2MB
MD5

5b1914a62235a396b7caed0b6625dd97
SHA1

c53b265f1101cc775cc591d312de6072fa53ce6e
SHA256

e5b78dd4d31d810e37a8b53d20c3351afe8e6186d90abd026d1d051a6e39ddeb
SHA512

fd6f81bac09781d52221fb86d7f2def9b8fb1df80dee6757c9865a86c9ce48edda0ab1d5e452fc4fa3ccb1658bc1d5cb7d30a76b7360c4bb77b311f1f1d5b208
SSDEEP

24576:IGp1/PD9pD6b3ewHdqoTL2lWA7QUgVs1bFBpWvyf7:IGpVPDSb/XL2lWmQRzI7

Score

10^/10

Family

raccoon

Botnet

ae72a9288d2ce774d14ddadddb8258c1

http://83.217.11.11/

rc4.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description pid process target process

PID 2596 set thread context of 4276 2596 Setup.exe Setup.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Setup.exe

pid process

2596 Setup.exe
2596 Setup.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Setup.exe

description pid process

Token: SeDebugPrivilege 2596 Setup.exe

description	pid	process	target process
PID 2596 set thread context of 4276	2596	Setup.exe	Setup.exe

pid	process
2596	Setup.exe
2596	Setup.exe

description	pid	process
Token: SeDebugPrivilege	2596	Setup.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Setup.exe

description	pid	process	target process
PID 2596 wrote to memory of 2312	2596	Setup.exe	Setup.exe
PID 2596 wrote to memory of 2312	2596	Setup.exe	Setup.exe
PID 2596 wrote to memory of 2312	2596	Setup.exe	Setup.exe
PID 2596 wrote to memory of 4276	2596	Setup.exe	Setup.exe
PID 2596 wrote to memory of 4276	2596	Setup.exe	Setup.exe
PID 2596 wrote to memory of 4276	2596	Setup.exe	Setup.exe
PID 2596 wrote to memory of 4276	2596	Setup.exe	Setup.exe
PID 2596 wrote to memory of 4276	2596	Setup.exe	Setup.exe
PID 2596 wrote to memory of 4276	2596	Setup.exe	Setup.exe
PID 2596 wrote to memory of 4276	2596	Setup.exe	Setup.exe
PID 2596 wrote to memory of 4276	2596	Setup.exe	Setup.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
2⤵
PID:2312

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
2⤵
PID:4276

memory/2312-137-0x0000000000000000-mapping.dmp

Download
memory/2596-132-0x0000000000740000-0x0000000000858000-memory.dmp

Filesize
1.1MB

Download
memory/2596-133-0x0000000005600000-0x0000000005BA4000-memory.dmp

Filesize
5.6MB

Download
memory/2596-134-0x00000000050F0000-0x0000000005182000-memory.dmp

Filesize
584KB

Download
memory/2596-135-0x00000000050C0000-0x00000000050CA000-memory.dmp

Filesize
40KB

Download
memory/2596-136-0x00000000053C0000-0x000000000545C000-memory.dmp

Filesize
624KB

Download
memory/4276-138-0x0000000000000000-mapping.dmp

Download
memory/4276-139-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4276-141-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4276-142-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download