raccoon | 3456b3d72716fa65c41d3b6d8ddd5e6c365cfb8c7fd298a57be5f30b6caf28dd

Analysis

max time kernel
93s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21-02-2023 04:05

Target

Setup.exe
Size

6.5MB
MD5

3282ea72e2abbbf6b4150816461125a2
SHA1

8bc40caa035804a6d99a09d34a1a9faa90ee78f0
SHA256

3456b3d72716fa65c41d3b6d8ddd5e6c365cfb8c7fd298a57be5f30b6caf28dd
SHA512

41a634a0268fead5f1f0cf76e473d36db141f149dea321e1ba56fb96d51070c60a65179fb422dec2e5017bcf571d294cd5f35c6abbe3d198919df24d67db8b02
SSDEEP

196608:ppUI+/B0d1FOw1vGzZQ7Ey3aHczOBfmpLHe+VV:cI7bowozaQy3NzOcHeo

Score

10^/10

Family

raccoon

Botnet

f1c3f7a3e12da19758239f0284e7dc2c

http://83.217.11.34

http://83.217.11.35

rc4.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Setup.exe

pid process

4968 Setup.exe
4968 Setup.exe

pid	process
4968	Setup.exe
4968	Setup.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4968

memory/4968-133-0x0000000000E50000-0x0000000000E51000-memory.dmp

Filesize
4KB

Download
memory/4968-134-0x0000000000E60000-0x0000000000E61000-memory.dmp

Filesize
4KB

Download
memory/4968-135-0x0000000000E70000-0x0000000000E71000-memory.dmp

Filesize
4KB

Download
memory/4968-136-0x0000000000E90000-0x0000000000E91000-memory.dmp

Filesize
4KB

Download
memory/4968-137-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Filesize
4KB

Download
memory/4968-138-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/4968-139-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

Filesize
4KB

Download
memory/4968-140-0x0000000000400000-0x0000000000E41000-memory.dmp

Filesize
10.3MB

Download