Overview

overview

10

Static

static

1CDF.exe

windows7_x64

10

1CDF.exe

windows10_x64

10

Analysis

  • max time kernel
    154s
  • max time network
    154s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    04-12-2021 19:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1CDF.exe

  • Size

    543KB

  • MD5

    b01eb876b50bb103ecd0131707672fdc

  • SHA1

    3886e5aef519a9a8526dcfd2487393c4f32cc077

  • SHA256

    25128763bec88f9e6b4a99d05f4aa46fd3694452851fda8b1b5cbc0eb0474fa6

  • SHA512

    5f43bc5eb586d143bf59a655ddb64fe7b81b1fbd9db7fb7efb3585712d5615bd83610ab02d56289932058513df8ed3a545c7673a49c5264d97ae70822d3450d0

Score
10/10
raccoonb2ef6df07cefd70742a1d2de874b0494a6c0af23stealer

Malware Config

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

b2ef6df07cefd70742a1d2de874b0494a6c0af23

Attributes
  • url4cnc

    http://94.158.245.137/lesterri2

    http://91.219.236.27/lesterri2

    http://94.158.245.167/lesterri2

    http://185.163.204.216/lesterri2

    http://185.225.19.238/lesterri2

    http://185.163.204.218/lesterri2

    https://t.me/lesterri2

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

Processes

  • C:\Users\Admin\AppData\Local\Temp\1CDF.exe
    "C:\Users\Admin\AppData\Local\Temp\1CDF.exe"
    1⤵
      PID:2724

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2724-118-0x0000000000719000-0x0000000000768000-memory.dmp
      Filesize

      316KB

      Download
    • memory/2724-119-0x00000000020E0000-0x000000000216F000-memory.dmp
      Filesize

      572KB

      Download
    • memory/2724-120-0x0000000000400000-0x0000000000491000-memory.dmp
      Filesize

      580KB

      Download