raccoon | f63154fccd7521dbe450f56aefff2a73d199489f8b68be7bd03befc5a98ddc36

Analysis

max time kernel
101s
max time network
91s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17-06-2023 19:08

Target

file.exe
Size

336KB
MD5

e94ec358349808b167fe25704bbb1c43
SHA1

6c48cab4905b96605d64de1718c6fe07b17392c0
SHA256

f63154fccd7521dbe450f56aefff2a73d199489f8b68be7bd03befc5a98ddc36
SHA512

a2a890b872704b49b0692b077439ee2a65e73641553729f614c5b230df0591d59984f3d564ffde9d11223133bedaf4a70e2db7075b4e5ca9de9d8bd5f7798ad7
SSDEEP

6144:b46HZImXdPNhShn6XpLaJba4XcwfkBYuOVx6rfWd+V9nJ2/FnRy5pg:b46HZlXXhOnY9a9PswfkBYuo0DLnJ2dP

Score

10^/10

Family

raccoon

Botnet

a8557a01243914ccfb9f74ba3a926fa2

http://5.42.64.17:80/

http://5.42.65.62:80/

xor.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1940-60-0x0000000000400000-0x000000000041F000-memory.dmp	family_raccoon
behavioral1/memory/1940-61-0x0000000000400000-0x000000000041F000-memory.dmp	family_raccoon
behavioral1/memory/1940-62-0x0000000000400000-0x000000000041F000-memory.dmp	family_raccoon
behavioral1/memory/1940-64-0x0000000000400000-0x000000000041F000-memory.dmp	family_raccoon
behavioral1/memory/1940-66-0x0000000000400000-0x000000000041F000-memory.dmp	family_raccoon
behavioral1/memory/1940-67-0x0000000000400000-0x000000000041F000-memory.dmp	family_raccoon

Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 1408 set thread context of 1940 1408 file.exe file.exe

description	pid	process	target process
PID 1408 set thread context of 1940	1408	file.exe	file.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

file.exe

description	pid	process	target process
PID 1408 wrote to memory of 1940	1408	file.exe	file.exe
PID 1408 wrote to memory of 1940	1408	file.exe	file.exe
PID 1408 wrote to memory of 1940	1408	file.exe	file.exe
PID 1408 wrote to memory of 1940	1408	file.exe	file.exe
PID 1408 wrote to memory of 1940	1408	file.exe	file.exe
PID 1408 wrote to memory of 1940	1408	file.exe	file.exe
PID 1408 wrote to memory of 1940	1408	file.exe	file.exe
PID 1408 wrote to memory of 1940	1408	file.exe	file.exe
PID 1408 wrote to memory of 1940	1408	file.exe	file.exe
PID 1408 wrote to memory of 1940	1408	file.exe	file.exe
PID 1408 wrote to memory of 1940	1408	file.exe	file.exe
PID 1408 wrote to memory of 1940	1408	file.exe	file.exe
PID 1408 wrote to memory of 1940	1408	file.exe	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  PID:1940

memory/1408-54-0x0000000000320000-0x000000000037A000-memory.dmp

Filesize
360KB

Download
memory/1408-55-0x0000000000380000-0x00000000003BA000-memory.dmp

Filesize
232KB

Download
memory/1408-56-0x00000000003E0000-0x0000000000420000-memory.dmp

Filesize
256KB

Download
memory/1408-57-0x00000000003C0000-0x00000000003CA000-memory.dmp

Filesize
40KB

Download
memory/1940-58-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1940-59-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1940-60-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1940-61-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1940-62-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1940-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1940-64-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1940-66-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1940-67-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download