raccoon | 1804570x00000000004000000[.]dmp | Triage

Sharing

General

Target

1804570x00000000004000000.dmp
Size

23.3MB
MD5

d0450fd2d61b97b40e478621e030f77d
SHA1

2169182dfd285adb335c0a90743d1db14b8e4b13
SHA256

fd6d1f06c3430e937050657a82340bb1d4e337d709a0179e6caf83facb26b67c
SHA512

8833addf4c2a9f3a2f2eb07ef59f8123e10e5fe3dca61011bf4bb1abf82c2e4acadf367d709734f7311031a1c51565f9b7ed6a23810fb8485578835ef69d8ec7
SSDEEP

3072:YyXrxebtMhFG8yyrHe6PKMFrXh5ibGflYkLePKlm6jM:YIr8tcBTJy+bhaM9qK5

Score

10^/10

ibytetowidechar raccoon

Malware Config

Extracted

Family

raccoon

Botnet

iByteToWideChar

xor.plain

Signatures

Raccoon Stealer payload 1 IoCs

Processes:

resource yara_rule

sample family_raccoon
Raccoon family
raccoon
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

1804570x00000000004000000.dmp

Files

1804570x00000000004000000.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE