raccoon | 85ab17e1b22b87b9aa6058da5a239f41efb41f6e12f25c380508c636053e4975

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2024 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50516ba042ed1aaae22e56c6507c2bfb.exe
Size

2.7MB
MD5

50516ba042ed1aaae22e56c6507c2bfb
SHA1

a462d0473733f518807bd380d9468eb94321abb6
SHA256

85ab17e1b22b87b9aa6058da5a239f41efb41f6e12f25c380508c636053e4975
SHA512

8a5ccc941e3cc4793651e0ba1e2775cc9f6782235eee32854b7be961dbc44c3d9e260e5c17c9c0224a2a2e441dc6a26014b3fe8cc21716d7e4d17be476eb9ce8
SSDEEP

49152:pr9V00000000000000000000000000l1zILnkoyQ:pBV00000000000000000000000000Un7

Score

10^/10

raccoon stealer

Malware Config

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3532-12-0x0000000002810000-0x000000000289E000-memory.dmp	family_raccoon_v1

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

50516ba042ed1aaae22e56c6507c2bfb.exe

pid	process
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe
3532	50516ba042ed1aaae22e56c6507c2bfb.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3576 Explorer.EXE
Suspicious use of WriteProcessMemory 1 IoCs

Processes:

50516ba042ed1aaae22e56c6507c2bfb.exe

description pid process target process

PID 3532 wrote to memory of 3576 3532 50516ba042ed1aaae22e56c6507c2bfb.exe Explorer.EXE

pid	process
3576	Explorer.EXE

description	pid	process	target process
PID 3532 wrote to memory of 3576	3532	50516ba042ed1aaae22e56c6507c2bfb.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
PID:3576

C:\Users\Admin\AppData\Local\Temp\50516ba042ed1aaae22e56c6507c2bfb.exe
"C:\Users\Admin\AppData\Local\Temp\50516ba042ed1aaae22e56c6507c2bfb.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3532-8-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/3532-10-0x00000000008A0000-0x00000000008A1000-memory.dmp

Filesize
4KB

Download
memory/3532-2-0x0000000077742000-0x0000000077743000-memory.dmp

Filesize
4KB

Download
memory/3532-3-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/3532-4-0x0000000000CD0000-0x0000000000D4B000-memory.dmp

Filesize
492KB

Download
memory/3532-5-0x0000000002560000-0x0000000002703000-memory.dmp

Filesize
1.6MB

Download
memory/3532-1-0x0000000000CD0000-0x0000000000D4B000-memory.dmp

Filesize
492KB

Download
memory/3532-9-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/3532-0-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/3532-23-0x00000000008A0000-0x00000000008A1000-memory.dmp

Filesize
4KB

Download
memory/3532-12-0x0000000002810000-0x000000000289E000-memory.dmp

Filesize
568KB

Download
memory/3532-14-0x0000000002C80000-0x0000000002D3E000-memory.dmp

Filesize
760KB

Download
memory/3532-15-0x0000000002D80000-0x0000000003049000-memory.dmp

Filesize
2.8MB

Download
memory/3532-22-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/3576-11-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download