raccoon | a69eda298867c4f681ba85d6b9e63d4ac5a6865498d10e3ee939cf3533d150d6

Analysis

max time kernel
58s
max time network
50s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20-06-2023 08:24

Target

b6f7590b08d254d5e203c0dd1307cfc3.exe
Size

16.3MB
MD5

b6f7590b08d254d5e203c0dd1307cfc3
SHA1

4276690cde09f8dc343b869a206d723f6e095a39
SHA256

a69eda298867c4f681ba85d6b9e63d4ac5a6865498d10e3ee939cf3533d150d6
SHA512

99d562a74f271a8d428f23817d95d465d2bff889c9ef18a975451e61655ebabcc7dae90874f0590aeb210c34ef65dcef27612d7bac95ea638f527617ff3a33a5
SSDEEP

196608:CzYb3pRrsY07EQGOcoUnxLVdDCDLU4T5X0UwqIXZsdb56rBPTLprGOXaPVBEf5QR:CzYg/YQGOcfnxLD6T5JwquZKOLpGNPz

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/820-57-0x0000000000400000-0x0000000001E14000-memory.dmp	family_raccoon

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

b6f7590b08d254d5e203c0dd1307cfc3.exe

pid process

820 b6f7590b08d254d5e203c0dd1307cfc3.exe

pid	process
820	b6f7590b08d254d5e203c0dd1307cfc3.exe

C:\Users\Admin\AppData\Local\Temp\b6f7590b08d254d5e203c0dd1307cfc3.exe
"C:\Users\Admin\AppData\Local\Temp\b6f7590b08d254d5e203c0dd1307cfc3.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:820

memory/820-55-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/820-54-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/820-56-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/820-57-0x0000000000400000-0x0000000001E14000-memory.dmp

Filesize
26.1MB

Download