raccoon | 983dfa8c2d0b3504397327fcfa783e96e39538d0a8496b9ee912c18210adbe5b

Analysis

max time kernel
148s
max time network
156s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 04:01

Target

5288023466d3fb96b19334b2518118f5.exe
Size

531KB
MD5

5288023466d3fb96b19334b2518118f5
SHA1

0411581d274e8dd02cdafe912d43b6df59f0ce0b
SHA256

983dfa8c2d0b3504397327fcfa783e96e39538d0a8496b9ee912c18210adbe5b
SHA512

c260a7dee278e2447df63575a833cd4a6e8db4eb5f81f40ce0622308f832cc75afb68d96b9e4078b878e2f2eb063aa2f35ce7760ecd15f2d61bbf9e6a2806c65
SSDEEP

12288:ah77hp/a2CBWQ3gnVZd3OOm9Fd/rL2qsdG+hB+/e:ehpZCBWQQnVZNOT9F5mG+h8/e

Score

10^/10

Family

raccoon

Version

1.7.3

Botnet

92be0387873e54dd629b9bfa972c3a9a88e6726c

Attributes

rc4.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2920-4-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral1/memory/2920-7-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral1/memory/2920-8-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral1/memory/2920-9-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1

Suspicious use of SetThreadContext 1 IoCs

Processes:

5288023466d3fb96b19334b2518118f5.exe

description pid process target process

PID 1104 set thread context of 2920 1104 5288023466d3fb96b19334b2518118f5.exe 5288023466d3fb96b19334b2518118f5.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5288023466d3fb96b19334b2518118f5.exe

description pid process

Token: SeDebugPrivilege 1104 5288023466d3fb96b19334b2518118f5.exe

description	pid	process	target process
PID 1104 set thread context of 2920	1104	5288023466d3fb96b19334b2518118f5.exe	5288023466d3fb96b19334b2518118f5.exe

description	pid	process
Token: SeDebugPrivilege	1104	5288023466d3fb96b19334b2518118f5.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

5288023466d3fb96b19334b2518118f5.exe

description	pid	process	target process
PID 1104 wrote to memory of 2920	1104	5288023466d3fb96b19334b2518118f5.exe	5288023466d3fb96b19334b2518118f5.exe
PID 1104 wrote to memory of 2920	1104	5288023466d3fb96b19334b2518118f5.exe	5288023466d3fb96b19334b2518118f5.exe
PID 1104 wrote to memory of 2920	1104	5288023466d3fb96b19334b2518118f5.exe	5288023466d3fb96b19334b2518118f5.exe
PID 1104 wrote to memory of 2920	1104	5288023466d3fb96b19334b2518118f5.exe	5288023466d3fb96b19334b2518118f5.exe
PID 1104 wrote to memory of 2920	1104	5288023466d3fb96b19334b2518118f5.exe	5288023466d3fb96b19334b2518118f5.exe
PID 1104 wrote to memory of 2920	1104	5288023466d3fb96b19334b2518118f5.exe	5288023466d3fb96b19334b2518118f5.exe
PID 1104 wrote to memory of 2920	1104	5288023466d3fb96b19334b2518118f5.exe	5288023466d3fb96b19334b2518118f5.exe
PID 1104 wrote to memory of 2920	1104	5288023466d3fb96b19334b2518118f5.exe	5288023466d3fb96b19334b2518118f5.exe
PID 1104 wrote to memory of 2920	1104	5288023466d3fb96b19334b2518118f5.exe	5288023466d3fb96b19334b2518118f5.exe
PID 1104 wrote to memory of 2920	1104	5288023466d3fb96b19334b2518118f5.exe	5288023466d3fb96b19334b2518118f5.exe

C:\Users\Admin\AppData\Local\Temp\5288023466d3fb96b19334b2518118f5.exe
C:\Users\Admin\AppData\Local\Temp\5288023466d3fb96b19334b2518118f5.exe
2⤵
PID:2920

memory/1104-0-0x0000000001370000-0x00000000013F8000-memory.dmp

Filesize
544KB

Download
memory/1104-1-0x0000000074260000-0x000000007494E000-memory.dmp

Filesize
6.9MB

Download
memory/1104-2-0x0000000000BA0000-0x0000000000BE0000-memory.dmp

Filesize
256KB

Download
memory/1104-3-0x00000000004B0000-0x00000000004D0000-memory.dmp

Filesize
128KB

Download
memory/1104-6-0x0000000074260000-0x000000007494E000-memory.dmp

Filesize
6.9MB

Download
memory/2920-4-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2920-7-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2920-8-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2920-9-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download