raccoon | a7b25c3995f6bc79c2075efbb0bbdbcc0a3cc7fccb920b6c760981cd866ed89a

Analysis

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2023, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
123.exe
Size 518KB
Sample230508-twydsabf34
SHA256 a7b25c3995f6bc79c2075efbb0bbdbcc0a3cc7fccb920b6c760981cd866ed89a
MD5 2aeac863392c9a2a31058c6d5eeb4cc2
SHA1 a45b2e4905117c4dae0a3666a4590f538b69fdcc
SHA512 fb04c05b3aacdae462c960fa10610b67f39ec3188d4d248e207853090d3809953b5a6fee96a58029aa13b5d526fec43161913842c230932b84063f61a2b4102e
SSDEEP 12288:hnNXliRo0L376ujZIBalmrh0Jzw2NXegPTHrHlRwzYLSmhrWE:pfwo0LWujZIzrhQw2FegrHhRwzYLSwr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

raccoon b11c37ed36597cb6d2adb8b6280a6e12 stealer

Malware Config

Extracted

Family

raccoon

Botnet

b11c37ed36597cb6d2adb8b6280a6e12

http://94.142.138.32

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4172 set thread context of 1320	4172	123.exe	91

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 1320	4172	123.exe	91
PID 4172 wrote to memory of 1320	4172	123.exe	91
PID 4172 wrote to memory of 1320	4172	123.exe	91
PID 4172 wrote to memory of 1320	4172	123.exe	91
PID 4172 wrote to memory of 1320	4172	123.exe	91
PID 4172 wrote to memory of 1320	4172	123.exe	91
PID 4172 wrote to memory of 1320	4172	123.exe	91
PID 4172 wrote to memory of 1320	4172	123.exe	91
PID 4172 wrote to memory of 1320	4172	123.exe	91

C:\Users\Admin\AppData\Local\Temp\123.exe
"C:\Users\Admin\AppData\Local\Temp\123.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Users\Admin\AppData\Local\Temp\123.exe
  "C:\Users\Admin\AppData\Local\Temp\123.exe"
  2⤵
  PID:1320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1320-140-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/1320-143-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/1320-144-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4172-133-0x0000000000AB0000-0x0000000000B38000-memory.dmp

Download

memory/4172-134-0x0000000005A70000-0x0000000006014000-memory.dmp

Download

memory/4172-135-0x0000000005560000-0x00000000055F2000-memory.dmp

Download

memory/4172-136-0x0000000005510000-0x000000000551A000-memory.dmp

Download

memory/4172-137-0x0000000005720000-0x0000000005730000-memory.dmp

Download

memory/4172-138-0x0000000005720000-0x0000000005730000-memory.dmp

Download

memory/4172-139-0x0000000007140000-0x00000000071DC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads