raccoon | 324-60-0x0000000000400000-0x0000000001C21000-memory[.]dmp

General

Target
324-60-0x0000000000400000-0x0000000001C21000-memory.dmp
Size 24.1MB
Sample240303-dn2s8sca51
SHA256 be1c1fa4f6ceb80a6122fcc9595420e7ecd8da936538a0f69b14ec0e17bb7712
MD5 e92043f54460d25ff810214e61b0332f
SHA1 d981b3d670784a1e3224c5be07062a81596330a6
SHA512 68b238f7bbfb15d013f3e91f7dd7440308e9a66f02d6015a1b54be612ffcb4c99c8299cb5b9f99c0b06551512cc525022c19f60cdc08b98c2223d6be67faef8b
SSDEEP 786432:PA/5OOGezZykBqlz6RFzSYCweyPBxo1lQq:okwzkkwlz5Yxea6C
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

0cd608d076a2fb6b8f97e6653af6873f raccoon

Malware Config

Extracted

Family

raccoon

Botnet

0cd608d076a2fb6b8f97e6653af6873f

C2

http://83.217.11.10
http://83.217.11.11

Attributes

user_agent
901785252112

xor.plain

Signatures

Raccoon Stealer V2 payload 1 IoCs

resource	yara_rule
sample	family_raccoon_v2

Raccoon family
raccoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
324-60-0x0000000000400000-0x0000000001C21000-memory.dmp

File Explorer

324-60-0x0000000000400000-0x0000000001C21000-memory.dmp

.exe 24.1MB

324-60-0x0000000000400000-0x0000000001C21000-memory.dmp

SHA256 be1c1fa4f6ceb80a6122fcc9595420e7ecd8da936538a0f69b14ec0e17bb7712
MD5 e92043f54460d25ff810214e61b0332f
SHA1 d981b3d670784a1e3224c5be07062a81596330a6
SHA512 68b238f7bbfb15d013f3e91f7dd7440308e9a66f02d6015a1b54be612ffcb4c99c8299cb5b9f99c0b06551512cc525022c19f60cdc08b98c2223d6be67faef8b
SSDEEP 786432:PA/5OOGezZykBqlz6RFzSYCweyPBxo1lQq:okwzkkwlz5Yxea6C
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Raccoon Stealer V2 payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

11387415

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.c"5

Size

Virtual Size

10.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.J`w

Size

1024B

Virtual Size

904B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.\(r

Size

13.1MB

Virtual Size

13.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

353KB

Virtual Size

352KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

324-60-0x0000000000400000-0x0000000001C21000-memory.dmp

generic