raccoon | 4e437636c9113fc73c86b22422c91c35cd11def1e1a8c28a3f2c596166c15bc3

Analysis

max time kernel
157s
max time network
224s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
21-02-2023 07:49

Target

Setup.exe
Size

726.5MB
MD5

930faa4f76f94b1e0fe712eef3a25105
SHA1

dc1e0bb6380d51c4f3634d8693f664517c8c80b3
SHA256

4e437636c9113fc73c86b22422c91c35cd11def1e1a8c28a3f2c596166c15bc3
SHA512

048f215f0bc041d0e1be070f98cd2bfc76a716a7556cc5760faf25154d0af1e10470ae2fef53e91e6a19b822153efe434f93180a8799a9868239fbf4819b4ea2
SSDEEP

196608:U3hC9zyNqkQPFwCEYZeDcUq2DqsMG/LgegNIwrM:r9zUq/PTEYkzqNgLgegy7

Score

10^/10

Family

raccoon

Botnet

717609e6131226f92ce8ce08c34305be

http://83.217.11.35

http://83.217.11.34

rc4.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Setup.exe

pid process

4620 Setup.exe
4620 Setup.exe

pid	process
4620	Setup.exe
4620	Setup.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4620

memory/4620-133-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/4620-134-0x0000000000E50000-0x0000000000E51000-memory.dmp

Filesize
4KB

Download
memory/4620-135-0x0000000000E60000-0x0000000000E61000-memory.dmp

Filesize
4KB

Download
memory/4620-136-0x0000000000E90000-0x0000000000E91000-memory.dmp

Filesize
4KB

Download
memory/4620-137-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Filesize
4KB

Download
memory/4620-138-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/4620-139-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

Filesize
4KB

Download
memory/4620-140-0x0000000000400000-0x0000000000E33000-memory.dmp

Filesize
10.2MB

Download