raccoon | f63154fccd7521dbe450f56aefff2a73d199489f8b68be7bd03befc5a98ddc36

Analysis

max time kernel
137s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17-06-2023 19:07

Target

file.exe
Size

336KB
MD5

e94ec358349808b167fe25704bbb1c43
SHA1

6c48cab4905b96605d64de1718c6fe07b17392c0
SHA256

f63154fccd7521dbe450f56aefff2a73d199489f8b68be7bd03befc5a98ddc36
SHA512

a2a890b872704b49b0692b077439ee2a65e73641553729f614c5b230df0591d59984f3d564ffde9d11223133bedaf4a70e2db7075b4e5ca9de9d8bd5f7798ad7
SSDEEP

6144:b46HZImXdPNhShn6XpLaJba4XcwfkBYuOVx6rfWd+V9nJ2/FnRy5pg:b46HZlXXhOnY9a9PswfkBYuo0DLnJ2dP

Score

10^/10

Family

raccoon

Botnet

a8557a01243914ccfb9f74ba3a926fa2

http://5.42.64.17:80/

http://5.42.65.62:80/

xor.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1636-142-0x0000000000400000-0x000000000041F000-memory.dmp	family_raccoon
behavioral2/memory/1636-140-0x0000000000400000-0x000000000041F000-memory.dmp	family_raccoon
behavioral2/memory/1636-144-0x0000000000400000-0x000000000041F000-memory.dmp	family_raccoon

Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 824 set thread context of 1636 824 file.exe file.exe

description	pid	process	target process
PID 824 set thread context of 1636	824	file.exe	file.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

file.exe

description	pid	process	target process
PID 824 wrote to memory of 3064	824	file.exe	file.exe
PID 824 wrote to memory of 3064	824	file.exe	file.exe
PID 824 wrote to memory of 3064	824	file.exe	file.exe
PID 824 wrote to memory of 1636	824	file.exe	file.exe
PID 824 wrote to memory of 1636	824	file.exe	file.exe
PID 824 wrote to memory of 1636	824	file.exe	file.exe
PID 824 wrote to memory of 1636	824	file.exe	file.exe
PID 824 wrote to memory of 1636	824	file.exe	file.exe
PID 824 wrote to memory of 1636	824	file.exe	file.exe
PID 824 wrote to memory of 1636	824	file.exe	file.exe
PID 824 wrote to memory of 1636	824	file.exe	file.exe
PID 824 wrote to memory of 1636	824	file.exe	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:824
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  PID:1636
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  PID:3064

memory/824-133-0x0000000000C10000-0x0000000000C6A000-memory.dmp

Filesize
360KB

Download
memory/824-134-0x0000000005BC0000-0x0000000006164000-memory.dmp

Filesize
5.6MB

Download
memory/824-135-0x00000000056B0000-0x0000000005742000-memory.dmp

Filesize
584KB

Download
memory/824-136-0x00000000057F0000-0x000000000588C000-memory.dmp

Filesize
624KB

Download
memory/824-137-0x00000000058D0000-0x00000000058E0000-memory.dmp

Filesize
64KB

Download
memory/824-138-0x00000000058E0000-0x0000000005956000-memory.dmp

Filesize
472KB

Download
memory/824-139-0x0000000005790000-0x00000000057AE000-memory.dmp

Filesize
120KB

Download
memory/1636-142-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1636-140-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1636-144-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download