raccoon | 6d5428ce4be04184f9c2f89a6a1646bffc718818c7a0af019207bd81cced4d06

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27-01-2024 22:05

Target

7b6726d6af9d674d6b7d96808eb70d26.exe
Size

636KB
MD5

7b6726d6af9d674d6b7d96808eb70d26
SHA1

a352653f8026c0f823c4d8bc3bd1668dff1e1ed3
SHA256

6d5428ce4be04184f9c2f89a6a1646bffc718818c7a0af019207bd81cced4d06
SHA512

1028a0130d392b4b84b5c82b0f9d40cbba53f41c50a184aafb8c1c6c3a41a033196c57b3b213ab765fd6babe83c1f232ef070aca2cbd44c7ac95f0961958b5bd
SSDEEP

12288:brFCG95RXgPtl4EqSaXbhJ1Xs3gnVZd3OOm9Fd/rL2qsdGWw/R2:brFfaPXPqS0hJ1XsQnVZNOT9F5mGWw/I

Score

10^/10

Family

raccoon

Version

1.7.3

Botnet

92be0387873e54dd629b9bfa972c3a9a88e6726c

Attributes

rc4.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2564-5-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral1/memory/2564-8-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral1/memory/2564-9-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1

Suspicious use of SetThreadContext 1 IoCs

Processes:

7b6726d6af9d674d6b7d96808eb70d26.exe

description pid process target process

PID 2044 set thread context of 2564 2044 7b6726d6af9d674d6b7d96808eb70d26.exe 7b6726d6af9d674d6b7d96808eb70d26.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7b6726d6af9d674d6b7d96808eb70d26.exe

description pid process

Token: SeDebugPrivilege 2044 7b6726d6af9d674d6b7d96808eb70d26.exe

description	pid	process	target process
PID 2044 set thread context of 2564	2044	7b6726d6af9d674d6b7d96808eb70d26.exe	7b6726d6af9d674d6b7d96808eb70d26.exe

description	pid	process
Token: SeDebugPrivilege	2044	7b6726d6af9d674d6b7d96808eb70d26.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

7b6726d6af9d674d6b7d96808eb70d26.exe

description	pid	process	target process
PID 2044 wrote to memory of 2564	2044	7b6726d6af9d674d6b7d96808eb70d26.exe	7b6726d6af9d674d6b7d96808eb70d26.exe
PID 2044 wrote to memory of 2564	2044	7b6726d6af9d674d6b7d96808eb70d26.exe	7b6726d6af9d674d6b7d96808eb70d26.exe
PID 2044 wrote to memory of 2564	2044	7b6726d6af9d674d6b7d96808eb70d26.exe	7b6726d6af9d674d6b7d96808eb70d26.exe
PID 2044 wrote to memory of 2564	2044	7b6726d6af9d674d6b7d96808eb70d26.exe	7b6726d6af9d674d6b7d96808eb70d26.exe
PID 2044 wrote to memory of 2564	2044	7b6726d6af9d674d6b7d96808eb70d26.exe	7b6726d6af9d674d6b7d96808eb70d26.exe
PID 2044 wrote to memory of 2564	2044	7b6726d6af9d674d6b7d96808eb70d26.exe	7b6726d6af9d674d6b7d96808eb70d26.exe
PID 2044 wrote to memory of 2564	2044	7b6726d6af9d674d6b7d96808eb70d26.exe	7b6726d6af9d674d6b7d96808eb70d26.exe
PID 2044 wrote to memory of 2564	2044	7b6726d6af9d674d6b7d96808eb70d26.exe	7b6726d6af9d674d6b7d96808eb70d26.exe
PID 2044 wrote to memory of 2564	2044	7b6726d6af9d674d6b7d96808eb70d26.exe	7b6726d6af9d674d6b7d96808eb70d26.exe
PID 2044 wrote to memory of 2564	2044	7b6726d6af9d674d6b7d96808eb70d26.exe	7b6726d6af9d674d6b7d96808eb70d26.exe

C:\Users\Admin\AppData\Local\Temp\7b6726d6af9d674d6b7d96808eb70d26.exe
C:\Users\Admin\AppData\Local\Temp\7b6726d6af9d674d6b7d96808eb70d26.exe
2⤵
PID:2564

memory/2044-0-0x0000000000DB0000-0x0000000000E52000-memory.dmp

Filesize
648KB

Download
memory/2044-1-0x00000000740B0000-0x000000007479E000-memory.dmp

Filesize
6.9MB

Download
memory/2044-2-0x0000000004CE0000-0x0000000004D20000-memory.dmp

Filesize
256KB

Download
memory/2044-3-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/2044-4-0x00000000006F0000-0x0000000000710000-memory.dmp

Filesize
128KB

Download
memory/2044-7-0x00000000740B0000-0x000000007479E000-memory.dmp

Filesize
6.9MB

Download
memory/2564-5-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2564-8-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2564-9-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download