Analysis

  • max time kernel
    139s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    20-11-2021 15:18

General

  • Target

    usfive_20211120-090723.exe

  • Size

    531KB

  • MD5

    e3d212953a7b761262c12d550d68ba90

  • SHA1

    30c3efd5df5197d99a3e269467d446d1e2fea75e

  • SHA256

    1a7618f8b32762de7c631842957163b7ec06d8904be15a6fcf94d3a9e4e623b7

  • SHA512

    c85031cbadf1f2f4513a67811f2bcfd4e6e6381a15ff25ef5b7e5c5a79c772556c517f15cce5a1e346f5085d6da979d9e04fc9e11517b59c1712084bf1b9a239

Malware Config

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

8b6023dd139bdc34aab99c286fae23d1442b4956

Attributes
  • url4cnc

    http://91.219.236.27/h_electricryptors2

    http://5.181.156.92/h_electricryptors2

    http://91.219.236.207/h_electricryptors2

    http://185.225.19.18/h_electricryptors2

    http://91.219.237.227/h_electricryptors2

    https://t.me/h_electricryptors2

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

Processes

  • C:\Users\Admin\AppData\Local\Temp\usfive_20211120-090723.exe
    "C:\Users\Admin\AppData\Local\Temp\usfive_20211120-090723.exe"
    1⤵
      PID:1660

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1660-55-0x0000000002FDB000-0x000000000302A000-memory.dmp
      Filesize

      316KB

    • memory/1660-56-0x0000000075C21000-0x0000000075C23000-memory.dmp
      Filesize

      8KB

    • memory/1660-57-0x0000000002DE0000-0x0000000002E6F000-memory.dmp
      Filesize

      572KB

    • memory/1660-58-0x0000000000400000-0x0000000002B7E000-memory.dmp
      Filesize

      39.5MB