raccoon | f89a1fc11a995b035aca4d23f8a391079e5d8f889b5a99866d07fdc755a65d77

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16/09/2023, 12:16

Target
93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe
Size 14.8MB
Sample230916-pff3caac81
SHA256 f89a1fc11a995b035aca4d23f8a391079e5d8f889b5a99866d07fdc755a65d77
MD5 93bdc8ce5d2c8ab79b21deb98cfea69a
SHA1 747228359905e5aef23e4b3239531477db3d4478
SHA512 887a8475647ab5b2206377dd500448b1c381f3e0f53cff5fe529f5710e0bf3571f6f8e3098e1f9bead784c248a8df211afd233ab4c6500c7813c6589e8fa182a
SSDEEP 98304:bdt7rcHOloky+h27UwdEW4jo51prMRAU5QWltnHwy555vKVA:bd1rcDUwuWOo2nHwm5pK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer payload 3 IoCs

resource	yara_rule
behavioral1/memory/2628-1-0x0000000000400000-0x000000000041B000-memory.dmp	family_raccoon
behavioral1/memory/2628-2-0x0000000000400000-0x000000000041B000-memory.dmp	family_raccoon
behavioral1/memory/2628-3-0x0000000000400000-0x000000000041B000-memory.dmp	family_raccoon

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2148 set thread context of 2628	2148	93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2148	93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2628	2148	93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe	29
PID 2148 wrote to memory of 2628	2148	93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe	29
PID 2148 wrote to memory of 2628	2148	93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe	29
PID 2148 wrote to memory of 2628	2148	93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe	29
PID 2148 wrote to memory of 2628	2148	93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe	29
PID 2148 wrote to memory of 2628	2148	93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe	29
PID 2148 wrote to memory of 2628	2148	93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe	29
PID 2148 wrote to memory of 2628	2148	93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe	29
PID 2148 wrote to memory of 2628	2148	93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe	29

C:\Users\Admin\AppData\Local\Temp\93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe
"C:\Users\Admin\AppData\Local\Temp\93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe"
  2⤵
  PID:2628

memory/2628-0-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2628-1-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2628-2-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2628-3-0x0000000000400000-0x000000000041B000-memory.dmp

Download