raccoon | caa19bec8d8cb712306e8f1662d9475bdcb0ea4d2434776a0cd199d7cbc5d2fa

Analysis

max time kernel
85s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2023 15:59

Target

FullSetup.exe
Size

1023.0MB
MD5

0d841e12892835ac7f4e6b862bcff9eb
SHA1

a9bf5e35571839a6b46ef0b7cc501f570910c67b
SHA256

11647cffa0619b1f643b6dd91fd6448c171eea5f7d101f54e5f27c4b19be80dc
SHA512

436e4f0bea2f0b24dcf62cc30ed7ceb38ca00966e24136d46c5a2de29438cf54127cb4625ce4b7b9257012ad211b57967ed44c4441db364062a5c409333e59b8
SSDEEP

196608:NIwGXgGtIGbzp9yYXOcpg73bQZ+cXFH+5Y/W57Cd4LpaGGU8m3sV//5XgfFIMcIV:yXXXDpFORruH+EWkdCwU8sIJYn

Score

10^/10

Family

raccoon

Botnet

13718a923845c0cdab8ce45c585b8d63

http://45.15.156.143/

rc4.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

FullSetup.exe

pid process

5088 FullSetup.exe
5088 FullSetup.exe

pid	process
5088	FullSetup.exe
5088	FullSetup.exe

C:\Users\Admin\AppData\Local\Temp\FullSetup.exe
"C:\Users\Admin\AppData\Local\Temp\FullSetup.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5088

memory/5088-133-0x0000000001C10000-0x0000000001C11000-memory.dmp

Filesize
4KB

Download
memory/5088-134-0x0000000000400000-0x0000000001A70000-memory.dmp

Filesize
22.4MB

Download