raccoon | 50ca22bad815ec837e9145bb7322e13989f2dd16a236268627d9098df28e68ba

Analysis

max time kernel
73s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2023 13:27

Target

66b045bac49f6e2c487b456981cc6477.exe
Size

473KB
MD5

66b045bac49f6e2c487b456981cc6477
SHA1

834524ab40413290c9ce6d16b9deaa443e3fe307
SHA256

50ca22bad815ec837e9145bb7322e13989f2dd16a236268627d9098df28e68ba
SHA512

da9ab9797dfecdeb4318a122a4acbcaa7c60899b36eb63bfa4cd1a1710f00e3e45edc25b84a5b651673f72b93d4be7222d6e203fcc30f9b330b5f1f4dd9a7219
SSDEEP

12288:Z0y/kAtFncvbzomo4mJy9xDqLh+a4dEs+N:ZT/kAtdcvIim2DqAa42s+N

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5084-8-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon
behavioral2/memory/5084-11-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon
behavioral2/memory/5084-13-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon

Suspicious use of SetThreadContext 1 IoCs

Processes:

66b045bac49f6e2c487b456981cc6477.exe

description pid process target process

PID 3292 set thread context of 5084 3292 66b045bac49f6e2c487b456981cc6477.exe 66b045bac49f6e2c487b456981cc6477.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

66b045bac49f6e2c487b456981cc6477.exe

description pid process

Token: SeDebugPrivilege 3292 66b045bac49f6e2c487b456981cc6477.exe

description	pid	process	target process
PID 3292 set thread context of 5084	3292	66b045bac49f6e2c487b456981cc6477.exe	66b045bac49f6e2c487b456981cc6477.exe

description	pid	process
Token: SeDebugPrivilege	3292	66b045bac49f6e2c487b456981cc6477.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

66b045bac49f6e2c487b456981cc6477.exe

description	pid	process	target process
PID 3292 wrote to memory of 5084	3292	66b045bac49f6e2c487b456981cc6477.exe	66b045bac49f6e2c487b456981cc6477.exe
PID 3292 wrote to memory of 5084	3292	66b045bac49f6e2c487b456981cc6477.exe	66b045bac49f6e2c487b456981cc6477.exe
PID 3292 wrote to memory of 5084	3292	66b045bac49f6e2c487b456981cc6477.exe	66b045bac49f6e2c487b456981cc6477.exe
PID 3292 wrote to memory of 5084	3292	66b045bac49f6e2c487b456981cc6477.exe	66b045bac49f6e2c487b456981cc6477.exe
PID 3292 wrote to memory of 5084	3292	66b045bac49f6e2c487b456981cc6477.exe	66b045bac49f6e2c487b456981cc6477.exe
PID 3292 wrote to memory of 5084	3292	66b045bac49f6e2c487b456981cc6477.exe	66b045bac49f6e2c487b456981cc6477.exe
PID 3292 wrote to memory of 5084	3292	66b045bac49f6e2c487b456981cc6477.exe	66b045bac49f6e2c487b456981cc6477.exe
PID 3292 wrote to memory of 5084	3292	66b045bac49f6e2c487b456981cc6477.exe	66b045bac49f6e2c487b456981cc6477.exe

C:\Users\Admin\AppData\Local\Temp\66b045bac49f6e2c487b456981cc6477.exe
C:\Users\Admin\AppData\Local\Temp\66b045bac49f6e2c487b456981cc6477.exe
2⤵
PID:5084

memory/3292-0-0x00000000001F0000-0x000000000026C000-memory.dmp

Filesize
496KB

Download
memory/3292-1-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/3292-2-0x0000000004C50000-0x0000000004C9C000-memory.dmp

Filesize
304KB

Download
memory/3292-3-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/3292-4-0x0000000002660000-0x0000000002694000-memory.dmp

Filesize
208KB

Download
memory/3292-5-0x0000000004CA0000-0x0000000004CD4000-memory.dmp

Filesize
208KB

Download
memory/3292-6-0x0000000004CD0000-0x0000000004D1C000-memory.dmp

Filesize
304KB

Download
memory/3292-7-0x0000000005310000-0x00000000058B4000-memory.dmp

Filesize
5.6MB

Download
memory/3292-12-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/5084-8-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/5084-11-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/5084-13-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download