raccoon | ea9801d82bc72a0903473c1422e291d54d080f30d255942de8a76d0ecfaabbfe

Analysis

max time kernel
142s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2023, 11:15

Target

668a08f06520c228006acc999d7387cd.exe
Size

316KB
MD5

668a08f06520c228006acc999d7387cd
SHA1

4319e8eed5471ba86fe2fd783bfd92e2e460c985
SHA256

ea9801d82bc72a0903473c1422e291d54d080f30d255942de8a76d0ecfaabbfe
SHA512

d77c08403fb57d000cba732d0f145f07dfbbc89c89df3a74cb3ed9a97d4de0deda10cc5312b126611db974fbe95e4ce1236272560336ad2bef2ece5e2da2c58d
SSDEEP

3072:QTMTrGg0Lucn1npBORDKHKxCsfkfZkwkGaXa+svl1+cy6R9BDI:UM2vL71pWhqZv+cy6

Score

10^/10

Family

raccoon

Botnet

bbbd8c4f062887157c5c54f47994f907

http://103.155.93.161/

rc4.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4572 set thread context of 1096	4572	668a08f06520c228006acc999d7387cd.exe	86

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 1096	4572	668a08f06520c228006acc999d7387cd.exe	86
PID 4572 wrote to memory of 1096	4572	668a08f06520c228006acc999d7387cd.exe	86
PID 4572 wrote to memory of 1096	4572	668a08f06520c228006acc999d7387cd.exe	86
PID 4572 wrote to memory of 1096	4572	668a08f06520c228006acc999d7387cd.exe	86
PID 4572 wrote to memory of 1096	4572	668a08f06520c228006acc999d7387cd.exe	86
PID 4572 wrote to memory of 1096	4572	668a08f06520c228006acc999d7387cd.exe	86
PID 4572 wrote to memory of 1096	4572	668a08f06520c228006acc999d7387cd.exe	86
PID 4572 wrote to memory of 1096	4572	668a08f06520c228006acc999d7387cd.exe	86

C:\Users\Admin\AppData\Local\Temp\668a08f06520c228006acc999d7387cd.exe
"C:\Users\Admin\AppData\Local\Temp\668a08f06520c228006acc999d7387cd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Users\Admin\AppData\Local\Temp\668a08f06520c228006acc999d7387cd.exe
  "C:\Users\Admin\AppData\Local\Temp\668a08f06520c228006acc999d7387cd.exe"
  2⤵
  PID:1096

memory/1096-134-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1096-136-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1096-138-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4572-137-0x00000000048F0000-0x000000000490D000-memory.dmp

Filesize
116KB

Download