raccoon | 1556-54-0x0000000000400000-0x000000000099B000-memory[.]dmp

General

Target
1556-54-0x0000000000400000-0x000000000099B000-memory.dmp
Size 5.6MB
Sample240304-1ycy7aff65
SHA256 a9ac013887c49da2d7b8256829dfdd3ec5dfbddb7109b2b605335d75afa9b0da
MD5 880f5ada0640ee89ed6c171f3c4903cb
SHA1 3a54ecc4fd9c3cd6bfed42fc433ee863f8b0cb71
SHA512 17be90a6419f6ad7ccfcdcf717ac39b0e9955c377560a1999dfe7e3e8598ee797f395149f5c6df3a29629ea4e06c30ac842fcc6eeb3f2f60bcc66b9d2659a06c
SSDEEP 98304:US99VuhEG1aPeZBS+lmHAsMHvimjyE/sSFHqys1lbki0zYNOUV3/pQcMfKuLD7A0:VuCG1XSTogE/FH3+6yhI1r4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

3b164269f2adf6743049d522e1af1845 raccoon

Malware Config

Extracted

Family

raccoon

Botnet

3b164269f2adf6743049d522e1af1845

C2

http://45.9.74.36/
http://45.9.74.34/

Attributes

user_agent
B1D3N_RIM_MY_ASS

xor.plain

Signatures

Raccoon Stealer V2 payload 1 IoCs

resource	yara_rule
sample	family_raccoon_v2

Raccoon family
raccoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1556-54-0x0000000000400000-0x000000000099B000-memory.dmp

File Explorer

1556-54-0x0000000000400000-0x000000000099B000-memory.dmp

.exe 5.6MB

1556-54-0x0000000000400000-0x000000000099B000-memory.dmp

SHA256 a9ac013887c49da2d7b8256829dfdd3ec5dfbddb7109b2b605335d75afa9b0da
MD5 880f5ada0640ee89ed6c171f3c4903cb
SHA1 3a54ecc4fd9c3cd6bfed42fc433ee863f8b0cb71
SHA512 17be90a6419f6ad7ccfcdcf717ac39b0e9955c377560a1999dfe7e3e8598ee797f395149f5c6df3a29629ea4e06c30ac842fcc6eeb3f2f60bcc66b9d2659a06c
SSDEEP 98304:US99VuhEG1aPeZBS+lmHAsMHvimjyE/sSFHqys1lbki0zYNOUV3/pQcMfKuLD7A0:VuCG1XSTogE/FH3+6yhI1r4
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Raccoon Stealer V2 payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

3273727

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp+-_0

Size

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp+-_1

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp+-_2

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

124KB

Virtual Size

181KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

1556-54-0x0000000000400000-0x000000000099B000-memory.dmp

generic