raccoon | f89a1fc11a995b035aca4d23f8a391079e5d8f889b5a99866d07fdc755a65d77

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
16/09/2023, 12:16

Target
93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe
Size 14.8MB
Sample230916-pff3caac81
SHA256 f89a1fc11a995b035aca4d23f8a391079e5d8f889b5a99866d07fdc755a65d77
MD5 93bdc8ce5d2c8ab79b21deb98cfea69a
SHA1 747228359905e5aef23e4b3239531477db3d4478
SHA512 887a8475647ab5b2206377dd500448b1c381f3e0f53cff5fe529f5710e0bf3571f6f8e3098e1f9bead784c248a8df211afd233ab4c6500c7813c6589e8fa182a
SSDEEP 98304:bdt7rcHOloky+h27UwdEW4jo51prMRAU5QWltnHwy555vKVA:bd1rcDUwuWOo2nHwm5pK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer payload 3 IoCs

resource	yara_rule
behavioral2/memory/1956-1-0x0000000000400000-0x000000000041B000-memory.dmp	family_raccoon
behavioral2/memory/1956-2-0x0000000000400000-0x000000000041B000-memory.dmp	family_raccoon
behavioral2/memory/1956-3-0x0000000000400000-0x000000000041B000-memory.dmp	family_raccoon

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1320 set thread context of 1956	1320	93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe	88

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1320	93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe
1320	93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 1956	1320	93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe	88
PID 1320 wrote to memory of 1956	1320	93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe	88
PID 1320 wrote to memory of 1956	1320	93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe	88
PID 1320 wrote to memory of 1956	1320	93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe	88
PID 1320 wrote to memory of 1956	1320	93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe	88
PID 1320 wrote to memory of 1956	1320	93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe	88
PID 1320 wrote to memory of 1956	1320	93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe	88
PID 1320 wrote to memory of 1956	1320	93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe	88

C:\Users\Admin\AppData\Local\Temp\93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe
"C:\Users\Admin\AppData\Local\Temp\93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"
  2⤵
  PID:1956

memory/1956-0-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1956-1-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1956-2-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1956-3-0x0000000000400000-0x000000000041B000-memory.dmp

Download