raccoon | 1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9

General

Target

1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe
Size

89KB
MD5

d0fa79fc637c5916da8d7c2f07948933
SHA1

d4fb639fe811739c4adf2e62b5df1f8c9ab35c75
SHA256

1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9
SHA512

68bca697a0cb607b6d813ddd4656afaa617384dbbafecda6b4f03685da8fba8603d761e0cb56841a778e59908064ff93261e80bc2f19f6898240d0b2dd65dd4c
SSDEEP

1536:2PX4YBLPitzZgglqlwEmnFN+br133phXZ4gDjyAKrsTBLviJYPx5OSbDU9oBdh02:ZzZggAlwEAAbryXsTBTiJYPx5OSbEoBN

Score

10^/10

Family

raccoon

Botnet

8401e21bbb0060afb24ce21fda90f5cb

C2

http://195.20.16.155:80

Attributes

xor.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 5 IoCs

resource	yara_rule
behavioral1/memory/2308-5-0x0000000002100000-0x0000000004100000-memory.dmp	family_raccoon_v2
behavioral1/memory/2380-8-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral1/memory/2380-10-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral1/memory/2380-14-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral1/memory/2380-16-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs

resource	yara_rule
behavioral1/memory/2380-8-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/2380-10-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/2380-14-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/2380-16-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2308 set thread context of 2380	2308	1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3028	2380	WerFault.exe	29

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2380	2308	1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe	29
PID 2308 wrote to memory of 2380	2308	1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe	29
PID 2308 wrote to memory of 2380	2308	1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe	29
PID 2308 wrote to memory of 2380	2308	1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe	29
PID 2308 wrote to memory of 2380	2308	1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe	29
PID 2308 wrote to memory of 2380	2308	1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe	29
PID 2308 wrote to memory of 2380	2308	1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe	29
PID 2308 wrote to memory of 2380	2308	1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe	29
PID 2308 wrote to memory of 2380	2308	1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe	29
PID 2308 wrote to memory of 2380	2308	1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe	29
PID 2308 wrote to memory of 2380	2308	1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe	29
PID 2308 wrote to memory of 2380	2308	1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe	29
PID 2380 wrote to memory of 3028	2380	RegAsm.exe	30
PID 2380 wrote to memory of 3028	2380	RegAsm.exe	30
PID 2380 wrote to memory of 3028	2380	RegAsm.exe	30
PID 2380 wrote to memory of 3028	2380	RegAsm.exe	30

memory/2308-0-0x0000000000970000-0x000000000098C000-memory.dmp

Filesize
112KB

Download
memory/2308-2-0x0000000074A80000-0x000000007516E000-memory.dmp

Filesize
6.9MB

Download
memory/2308-5-0x0000000002100000-0x0000000004100000-memory.dmp

Filesize
32.0MB

Download
memory/2308-13-0x0000000074A80000-0x000000007516E000-memory.dmp

Filesize
6.9MB

Download
memory/2380-4-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2380-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2380-8-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2380-7-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2380-6-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2380-10-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2380-14-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2380-16-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download