raccoon | 1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
12-04-2024 14:31

Target

SecuriteInfo.com.Variant.Lazy.509335.4668.exe
Size

89KB
MD5

d0fa79fc637c5916da8d7c2f07948933
SHA1

d4fb639fe811739c4adf2e62b5df1f8c9ab35c75
SHA256

1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9
SHA512

68bca697a0cb607b6d813ddd4656afaa617384dbbafecda6b4f03685da8fba8603d761e0cb56841a778e59908064ff93261e80bc2f19f6898240d0b2dd65dd4c
SSDEEP

1536:2PX4YBLPitzZgglqlwEmnFN+br133phXZ4gDjyAKrsTBLviJYPx5OSbDU9oBdh02:ZzZggAlwEAAbryXsTBTiJYPx5OSbEoBN

Score

10^/10

Family

raccoon

Botnet

8401e21bbb0060afb24ce21fda90f5cb

http://195.20.16.155:80

Attributes

xor.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3104-4-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/3104-8-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/3104-12-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/2984-11-0x0000000002C10000-0x0000000004C10000-memory.dmp	family_raccoon_v2

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Variant.Lazy.509335.4668.exe

description pid process target process

PID 2984 set thread context of 3104 2984 SecuriteInfo.com.Variant.Lazy.509335.4668.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4700 3104 WerFault.exe RegAsm.exe

description	pid	process	target process
PID 2984 set thread context of 3104	2984	SecuriteInfo.com.Variant.Lazy.509335.4668.exe	RegAsm.exe

pid	pid_target	process	target process
4700	3104	WerFault.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

SecuriteInfo.com.Variant.Lazy.509335.4668.exe

description	pid	process	target process
PID 2984 wrote to memory of 3104	2984	SecuriteInfo.com.Variant.Lazy.509335.4668.exe	RegAsm.exe
PID 2984 wrote to memory of 3104	2984	SecuriteInfo.com.Variant.Lazy.509335.4668.exe	RegAsm.exe
PID 2984 wrote to memory of 3104	2984	SecuriteInfo.com.Variant.Lazy.509335.4668.exe	RegAsm.exe
PID 2984 wrote to memory of 3104	2984	SecuriteInfo.com.Variant.Lazy.509335.4668.exe	RegAsm.exe
PID 2984 wrote to memory of 3104	2984	SecuriteInfo.com.Variant.Lazy.509335.4668.exe	RegAsm.exe
PID 2984 wrote to memory of 3104	2984	SecuriteInfo.com.Variant.Lazy.509335.4668.exe	RegAsm.exe
PID 2984 wrote to memory of 3104	2984	SecuriteInfo.com.Variant.Lazy.509335.4668.exe	RegAsm.exe
PID 2984 wrote to memory of 3104	2984	SecuriteInfo.com.Variant.Lazy.509335.4668.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 576
3⤵
- Program crash
PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3104 -ip 3104
1⤵
PID:3840

memory/2984-0-0x0000000000800000-0x000000000081C000-memory.dmp

Filesize
112KB

Download
memory/2984-2-0x0000000074A20000-0x00000000751D0000-memory.dmp

Filesize
7.7MB

Download
memory/2984-10-0x0000000074A20000-0x00000000751D0000-memory.dmp

Filesize
7.7MB

Download
memory/2984-11-0x0000000002C10000-0x0000000004C10000-memory.dmp

Filesize
32.0MB

Download
memory/2984-13-0x0000000002C10000-0x0000000004C10000-memory.dmp

Filesize
32.0MB

Download
memory/3104-4-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3104-8-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3104-12-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download