raccoon | 305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890

Analysis

max time kernel
187s
max time network
254s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
22-11-2023 04:49

Target

305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe
Size

1001KB
MD5

2f9b3ebf19b5ad8781df519868710318
SHA1

7501b719d04879b4adf918d07a621c6497494193
SHA256

305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890
SHA512

2b338fc86ed6ad97c09227d27f9be3c013896d77ff93e61126bf6ad19ffe9cffb44cc26ca5f6290d8bfdf7c3850dfa8dd9f9f47d3dee2c4ff6b3e83d90da168c
SSDEEP

12288:sYv+YQwNb+zZtoDwjT8ACMJHmfrumiNLZZZlYY+0ASM4tuSL24RBVaA:h1Nb+z/oDwjTXHASfNLZZZlYY+wM4xeA

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3820-0-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon
behavioral2/memory/3820-2-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon
behavioral2/memory/3820-3-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon

Suspicious use of SetThreadContext 1 IoCs

Processes:

305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe

description	pid	process	target process
PID 2960 set thread context of 3820	2960	305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe

description	pid	process	target process
PID 2960 wrote to memory of 3820	2960	305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe	AppLaunch.exe
PID 2960 wrote to memory of 3820	2960	305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe	AppLaunch.exe
PID 2960 wrote to memory of 3820	2960	305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe	AppLaunch.exe
PID 2960 wrote to memory of 3820	2960	305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe	AppLaunch.exe
PID 2960 wrote to memory of 3820	2960	305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe	AppLaunch.exe
PID 2960 wrote to memory of 3820	2960	305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe	AppLaunch.exe
PID 2960 wrote to memory of 3820	2960	305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe	AppLaunch.exe
PID 2960 wrote to memory of 3820	2960	305795487baec2f39f775d4885ba5319fe80dda3420a81a914f822b902693890.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:3820

memory/3820-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3820-2-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3820-3-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download