raccoon | 0e8509172356d527eac4b14a90bbb8d541625884f720b88e902fc88e30d007bc

Analysis

max time kernel
140s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22-04-2024 18:49

Target

0e8509172356d527eac4b14a90bbb8d541625884f720b88e902fc88e30d007bc.exe
Size

337KB
MD5

eaafa70d95f1ac8d0ba678002c316870
SHA1

f716edc6c1897549c86a82ca763ce4b04224d5ea
SHA256

0e8509172356d527eac4b14a90bbb8d541625884f720b88e902fc88e30d007bc
SHA512

01d70885d95132a292c6cbabb0a2dc4517cc7e1821bad6adbb5ddd9ba1cbcfbf71addbf0974792797202dd49230a22bf19b7af93c98feec78bc3bb59c5e16004
SSDEEP

3072:ZdF2c/3qO8qQDzNbR8tYZm597CbWSCPvKXw/Z/c8p3o:LF2s3z8qQVtYYM5tCbteiA/B

Score

10^/10

Family

raccoon

Botnet

1b186ec3b9bf16462aab87ee1bbfe070

http://193.27.14.212:80

Attributes

xor.plain

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/472-1-0x0000000002780000-0x0000000002880000-memory.dmp	family_raccoon_v2
behavioral2/memory/472-2-0x0000000002630000-0x000000000264A000-memory.dmp	family_raccoon_v2
behavioral2/memory/472-3-0x0000000000400000-0x00000000025A7000-memory.dmp	family_raccoon_v2
behavioral2/memory/472-4-0x0000000000400000-0x00000000025A7000-memory.dmp	family_raccoon_v2
behavioral2/memory/472-5-0x0000000002630000-0x000000000264A000-memory.dmp	family_raccoon_v2

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/472-3-0x0000000000400000-0x00000000025A7000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/472-4-0x0000000000400000-0x00000000025A7000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

928 472 WerFault.exe 0e8509172356d527eac4b14a90bbb8d541625884f720b88e902fc88e30d007bc.exe

pid	pid_target	process	target process
928	472	WerFault.exe	0e8509172356d527eac4b14a90bbb8d541625884f720b88e902fc88e30d007bc.exe

C:\Users\Admin\AppData\Local\Temp\0e8509172356d527eac4b14a90bbb8d541625884f720b88e902fc88e30d007bc.exe
"C:\Users\Admin\AppData\Local\Temp\0e8509172356d527eac4b14a90bbb8d541625884f720b88e902fc88e30d007bc.exe"
1⤵
PID:472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 472 -s 9800
2⤵
- Program crash
PID:928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 472 -ip 472
1⤵
PID:1544

memory/472-1-0x0000000002780000-0x0000000002880000-memory.dmp

Filesize
1024KB

Download
memory/472-2-0x0000000002630000-0x000000000264A000-memory.dmp

Filesize
104KB

Download
memory/472-3-0x0000000000400000-0x00000000025A7000-memory.dmp

Filesize
33.7MB

Download
memory/472-4-0x0000000000400000-0x00000000025A7000-memory.dmp

Filesize
33.7MB

Download
memory/472-5-0x0000000002630000-0x000000000264A000-memory.dmp

Filesize
104KB

Download
memory/472-7-0x0000000002780000-0x0000000002880000-memory.dmp

Filesize
1024KB

Download