raccoon | 7e59452c10d407a0ec3a91d67ef93acdd56b8070f57904fc26656883f12d07d0

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2023 20:00

Target

7e59452c10d407a0ec3a91d67ef93acdd56b8070f57904fc26656883f12d07d0.exe
Size

1.3MB
MD5

d8560a7c131d8313f0f95e49e1aa0b73
SHA1

29eb7b94ca1d6d6fe2c4f37de6e89602d5cdab92
SHA256

7e59452c10d407a0ec3a91d67ef93acdd56b8070f57904fc26656883f12d07d0
SHA512

f65baaaab186c8fea4755486a03faf9589c65d910cd063320c7cc136e8022c2ccab4d7aef94dd2b1c8fe2a71a8d03d4ad0a2770240ea1dd9a5bf521f9f073f3b
SSDEEP

6144:Kqlq7ttfNq5vdvlomq+kc5SAOHFLSq4hZ/b+W6tKM5E5pe:K0q7ttfo5vvSLmq4b+WLpe

Score

10^/10

Family

raccoon

Botnet

5b7eff386f31487f5db4c7f0e4006546

http://165.232.118.86/

xor.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Suspicious use of SetThreadContext 1 IoCs

Processes:

7e59452c10d407a0ec3a91d67ef93acdd56b8070f57904fc26656883f12d07d0.exe

description	pid	process	target process
PID 4412 set thread context of 1048	4412	7e59452c10d407a0ec3a91d67ef93acdd56b8070f57904fc26656883f12d07d0.exe	RegSvcs.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3936 4412 WerFault.exe 7e59452c10d407a0ec3a91d67ef93acdd56b8070f57904fc26656883f12d07d0.exe

pid	pid_target	process	target process
3936	4412	WerFault.exe	7e59452c10d407a0ec3a91d67ef93acdd56b8070f57904fc26656883f12d07d0.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

7e59452c10d407a0ec3a91d67ef93acdd56b8070f57904fc26656883f12d07d0.exe

description	pid	process	target process
PID 4412 wrote to memory of 1048	4412	7e59452c10d407a0ec3a91d67ef93acdd56b8070f57904fc26656883f12d07d0.exe	RegSvcs.exe
PID 4412 wrote to memory of 1048	4412	7e59452c10d407a0ec3a91d67ef93acdd56b8070f57904fc26656883f12d07d0.exe	RegSvcs.exe
PID 4412 wrote to memory of 1048	4412	7e59452c10d407a0ec3a91d67ef93acdd56b8070f57904fc26656883f12d07d0.exe	RegSvcs.exe
PID 4412 wrote to memory of 1048	4412	7e59452c10d407a0ec3a91d67ef93acdd56b8070f57904fc26656883f12d07d0.exe	RegSvcs.exe
PID 4412 wrote to memory of 1048	4412	7e59452c10d407a0ec3a91d67ef93acdd56b8070f57904fc26656883f12d07d0.exe	RegSvcs.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:1048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 328
2⤵
- Program crash
PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4412 -ip 4412
1⤵
PID:3272

memory/1048-133-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1048-139-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download