raccoon | 97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2023 20:58

Target

f7ba0f7a61b8b51a5e1823d5fd274d12.exe
Size

629KB
MD5

f7ba0f7a61b8b51a5e1823d5fd274d12
SHA1

64b9713a552f1efb9865782c5eb181e4bf6a392c
SHA256

97230d986df3ea5ab1a95966a7cd14ff73744912d34edb7a72776b78440d9293
SHA512

029501cd62f5884a39013dc4515022747f8e40721490086d2d898e6ee257950b75fce19c0126236aaf46ff4268299cdd74ad7d0515484999a422817b76cf8ba8
SSDEEP

12288:6WGdbu38g1hhiyCCaXNQY0ERzcUKHYjzp489c93P7r9r/+ppppppppppppppppp6:6WKC8gXs7Cz89KHezKv1qzyb

Score

10^/10

Family

raccoon

Version

1.7.3

Botnet

e1705ddaac9f73881d2b3657a93827c883eac34f

Attributes

rc4.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1404-10-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/1404-11-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/1404-8-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/1404-13-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/1404-14-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1

Suspicious use of SetThreadContext 1 IoCs

Processes:

f7ba0f7a61b8b51a5e1823d5fd274d12.exe

description pid process target process

PID 4520 set thread context of 1404 4520 f7ba0f7a61b8b51a5e1823d5fd274d12.exe f7ba0f7a61b8b51a5e1823d5fd274d12.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f7ba0f7a61b8b51a5e1823d5fd274d12.exe

description pid process

Token: SeDebugPrivilege 4520 f7ba0f7a61b8b51a5e1823d5fd274d12.exe

description	pid	process	target process
PID 4520 set thread context of 1404	4520	f7ba0f7a61b8b51a5e1823d5fd274d12.exe	f7ba0f7a61b8b51a5e1823d5fd274d12.exe

description	pid	process
Token: SeDebugPrivilege	4520	f7ba0f7a61b8b51a5e1823d5fd274d12.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

f7ba0f7a61b8b51a5e1823d5fd274d12.exe

description	pid	process	target process
PID 4520 wrote to memory of 1404	4520	f7ba0f7a61b8b51a5e1823d5fd274d12.exe	f7ba0f7a61b8b51a5e1823d5fd274d12.exe
PID 4520 wrote to memory of 1404	4520	f7ba0f7a61b8b51a5e1823d5fd274d12.exe	f7ba0f7a61b8b51a5e1823d5fd274d12.exe
PID 4520 wrote to memory of 1404	4520	f7ba0f7a61b8b51a5e1823d5fd274d12.exe	f7ba0f7a61b8b51a5e1823d5fd274d12.exe
PID 4520 wrote to memory of 1404	4520	f7ba0f7a61b8b51a5e1823d5fd274d12.exe	f7ba0f7a61b8b51a5e1823d5fd274d12.exe
PID 4520 wrote to memory of 1404	4520	f7ba0f7a61b8b51a5e1823d5fd274d12.exe	f7ba0f7a61b8b51a5e1823d5fd274d12.exe
PID 4520 wrote to memory of 1404	4520	f7ba0f7a61b8b51a5e1823d5fd274d12.exe	f7ba0f7a61b8b51a5e1823d5fd274d12.exe
PID 4520 wrote to memory of 1404	4520	f7ba0f7a61b8b51a5e1823d5fd274d12.exe	f7ba0f7a61b8b51a5e1823d5fd274d12.exe
PID 4520 wrote to memory of 1404	4520	f7ba0f7a61b8b51a5e1823d5fd274d12.exe	f7ba0f7a61b8b51a5e1823d5fd274d12.exe
PID 4520 wrote to memory of 1404	4520	f7ba0f7a61b8b51a5e1823d5fd274d12.exe	f7ba0f7a61b8b51a5e1823d5fd274d12.exe

C:\Users\Admin\AppData\Local\Temp\f7ba0f7a61b8b51a5e1823d5fd274d12.exe
C:\Users\Admin\AppData\Local\Temp\f7ba0f7a61b8b51a5e1823d5fd274d12.exe
2⤵
PID:1404

memory/1404-10-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/1404-14-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/1404-13-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/1404-8-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/1404-11-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/4520-6-0x0000000005350000-0x0000000005360000-memory.dmp

Filesize
64KB

Download
memory/4520-1-0x00000000748F0000-0x00000000750A0000-memory.dmp

Filesize
7.7MB

Download
memory/4520-7-0x00000000052F0000-0x0000000005304000-memory.dmp

Filesize
80KB

Download
memory/4520-5-0x00000000748F0000-0x00000000750A0000-memory.dmp

Filesize
7.7MB

Download
memory/4520-12-0x00000000748F0000-0x00000000750A0000-memory.dmp

Filesize
7.7MB

Download
memory/4520-4-0x0000000002DC0000-0x0000000002DDE000-memory.dmp

Filesize
120KB

Download
memory/4520-3-0x0000000005270000-0x00000000052E6000-memory.dmp

Filesize
472KB

Download
memory/4520-2-0x0000000005350000-0x0000000005360000-memory.dmp

Filesize
64KB

Download
memory/4520-0-0x0000000000840000-0x00000000008E0000-memory.dmp

Filesize
640KB

Download